Modern security-group ingress rule opens a management port to ::/0

What it checks

Modern security-group ingress rule opens a management port to ::/0

Where it applies

Terraform: aws_vpc_security_group_ingress_rule

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Replace ::/0 with a specific IPv6 prefix, an SG-to-SG reference (referenced_security_group_id), or move the port behind a VPN/SSM tunnel.
2. Check the IPv4 rule on the same security group and port — a correctly scoped cidr_ipv4 next to an open cidr_ipv6 is the common shape of this mistake.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules