Security-group ingress CIDRs are slices of the 0.0.0.0/0 supernet

What it checks

Security-group ingress CIDRs are slices of the 0.0.0.0/0 supernet

Where it applies

Terraform: aws_vpc_security_group_ingress_rule

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Replace the 0.0.0.0/0-rooted cidrsubnet expansion with an explicit list of corporate/VPN/partner CIDRs, or root the grid at your allocated supernet (e.g. 10.0.0.0/8) instead of 0.0.0.0/0.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules