Homepage

VPC security group inbound rule permits ingress from a public address to all ports and protocols Affecting VPC service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Network/ Public Access

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-ControlsCSA-CCMISO-27001NIST-800-53PCI-DSSSOC-2
  • Snyk IDSNYK-CC-00206
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. AWS recommends that no security groups explicitly allow inbound ports.

How to fix?

Set the ingress.cidr_blocks attribute with a more restrictive CIDR block, for example 192.168.1.0/24.

Example configuration:

resource "aws_security_group" "inbound-all-private" {
  name = "inbound-all-private"

  ingress {
    from_port = 0
    to_port = 0
    protocol = "-1"
    cidr_blocks = ["192.168.0.0/24"]
  }
}