Homepage

AWS security group rule allows public access Affecting VPC service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
General/ Public Access

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-Controls
  • Snyk IDSNYK-CC-00275
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Inbound traffic is allowed to a resource from any source instead of a restricted range, and potentially everyone can access your resource.

How to fix?

Set cidr_blocks attribute to specific CIDR block range only, e.g. 192.168.1.0/24.

Example Configuration

resource "aws_security_group_rule" "allowed" {
  type              = "ingress"
  from_port         = 0
  to_port           = 65535
  protocol          = "tcp"
  cidr_blocks       = ["192.168.1.0/24"]
  security_group_id = "sg-12345678"
}