Security group allows unrestricted ingress on all ports from the IPv6 internet

What it checks

Security group allows unrestricted ingress on all ports from the IPv6 internet

Where it applies

Terraform: aws_security_group, aws_security_group_rule

CloudFormation: AWS::EC2::SecurityGroup

How to fix it

1. Remove the protocol = -1 / ::/0 ingress rule. Replace with explicit per-service rules — only the ports your application actually listens on, with the narrowest IPv6 prefix possible.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules