Modern security-group ingress rule opens every port to 0.0.0.0/0

What it checks

Modern security-group ingress rule opens every port to 0.0.0.0/0

Where it applies

Terraform: aws_vpc_security_group_ingress_rule

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Delete this rule and declare one aws_vpc_security_group_ingress_rule per port the service actually listens on, each with the narrowest cidr_ipv4 that works.
2. For intra-VPC traffic use referenced_security_group_id instead of a CIDR, so the allowance follows the group rather than an address range.
3. Reach administrative ports through SSM Session Manager rather than an ingress rule, so port 22 needs no opening at all.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules