Security Group With Unrestricted Inbound Access
1
1
critical
What does ZopNight detect here?
Security groups exposing 0.0.0.0/0 ingress across all 65,535 ports, or to sensitive ports like 22, 3389, 3306, and 5432, are flagged as a governance finding with no dollar figure. ZopNight reads per-port evidence from DescribeSecurityGroupRules and abstains fail-closed when the rules could not be read.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-084 |
| Category | compliance |
| Severity | critical |
| Metric | none — pure configuration read |
| Source | security_group_open.go |
Where it applies
Which open ingress ranges count
- resource.Metadata: open_ports (string; the rule matches the verbatim “0-65535” all-ports sentinel) and public_ingress_ports (int array), stamped by the discoverer’s SecurityGroupProvider (security_group.go) from ec2:DescribeSecurityGroupRules. open_ports==“0-65535” is emitted only for an exact FromPort=0/ToPort=65535 range or an all-protocols (-1) rule; any other public-ingress range is enumerated into public_ingress_ports: fully for ranges up to 1024 ports wide, and (regardless of width) always including any sensitive port (22/3389/3306/5432/1433/27017/6379/9200) enclosed by the range, plus the two range boundaries for wider ranges. This closes a prior gap where a wide-but-not-full public range (e.g. 1-65535 written without the exact sentinel, or an app range like 2000-4000) recorded only its boundary ports and could silently miss an enclosed sensitive port. Abstains fail-closed when the discoverer could not read the rules (both keys omitted).
Why this rule carries no dollar saving
$0 (governance/compliance, no direct cost impact)
Locking the inbound rules down
- Go to EC2 Console → Security Groups → select the security group → Inbound rules
- Identify rules with source 0.0.0.0/0 or ::/0
- Replace 0.0.0.0/0 with specific IP ranges (your office CIDR, VPN CIDR, or specific service IPs)
- For services that must be publicly accessible, restrict to specific ports only (e.g., 443 for HTTPS)
- Use AWS Systems Manager Session Manager instead of opening SSH (port 22) to the internet
- Consider placing resources in private subnets behind a load balancer
Port evidence instead of a metric series
None (gate: per-port public_ingress_ports from discoverer; fires on 0.0.0.0/0 to a sensitive port (22/3389/3306/5432/1433/27017/6379/9200) or all-ports; abstains fail-closed on no port evidence). $0 security, no savings