Homepage

VPC security group attached to EC2 instance allows ingress from '0.0.0.0/0' to all ports Affecting VPC service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Network/ Public Access

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00471
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Because inbound traffic is allowed to a resource from any source instead of a restricted range, potentially everyone can access your resource.

How to fix?

Set ingress.cidr_blocks attribute with a more restrictive CIDR block, for example 192.16.0.0/24.

Example configuration:

resource "aws_security_group" "ingress-single-cidr-80-80" {
  name = "ingress-single-cidr-80-80"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port = 80
    to_port = 80
    protocol = "tcp"
    cidr_blocks = ["192.16.0.0/24"]
  }
}