Modern security-group ingress rule opens every port to ::/0

What it checks

Modern security-group ingress rule opens every port to ::/0

Where it applies

Terraform: aws_vpc_security_group_ingress_rule

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Replace ::/0 with the specific IPv6 prefix that needs access, and add ip_protocol / from_port / to_port naming the port the service listens on.
2. Check the IPv4 rules on the same security group — a correctly scoped cidr_ipv4 next to an unscoped cidr_ipv6 is the usual shape of this mistake.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules