Security group opens the complete TCP or UDP port range to the internet

What it checks

Security group: ingress rule opens the complete port range 0-65535 of a protocol to the internet (0.0.0.0/0).

Where it applies

Terraform: aws_security_group, aws_security_group_rule

CloudFormation: AWS::EC2::SecurityGroup

How to fix it

1. Remove the 0-65535 ingress rule. Replace with explicit per-service rules — only the ports your application actually listens on, with the narrowest CIDR possible.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules