Security-group ingress CIDRs resolve to the entire address space

What it checks

Security-group ingress CIDRs resolve to the entire address space

Where it applies

Terraform: aws_vpc_security_group_ingress_rule, aws_security_group, aws_security_group_rule

CloudFormation: AWS::EC2::SecurityGroup

How to fix it

1. Replace the resolved prefixes with an explicit list of corporate/VPN/partner CIDRs. If they arrive from a generated manifest, fix the manifest — the Terraform is faithfully applying what its data file declares, so editing the HCL alone will not close this.
2. Add a check to whatever generates the manifest that rejects any entry set whose union covers 0.0.0.0/0 or ::/0, so the next regeneration cannot reintroduce it.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules