Security group opens the complete TCP or UDP port range to the IPv6 internet

What it checks

Security group: ingress rule opens the complete port range 0-65535 of a protocol to the IPv6 internet (::/0).

Where it applies

Terraform: aws_security_group, aws_security_group_rule

CloudFormation: AWS::EC2::SecurityGroup

How to fix it

1. Remove the 0-65535 ingress rule. Replace with explicit per-service rules with the narrowest IPv6 prefix possible, or drop ipv6_cidr_blocks if the service is IPv4-only.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules