# Security Group With Unrestricted Inbound Access

> Security groups exposing 0.0.0.0/0 ingress across all 65,535 ports, or to sensitive ports like 22, 3389, 3306, and 5432, are flagged as a governance finding with no dollar figure. ZopNight reads per-port evidence from DescribeSecurityGroupRules and abstains fail-closed when the rules could not be read.

Source: https://zop.dev/integrations/aws/recommendations/security-group-with-unrestricted-inbound-access
Updated: 2026-08-19

---

## Which open ingress ranges count

- resource.Metadata: open_ports (string; the rule matches the verbatim "0-65535" all-ports sentinel) and public_ingress_ports (int array), stamped by the discoverer's SecurityGroupProvider (security_group.go) from ec2:DescribeSecurityGroupRules. open_ports=="0-65535" is emitted only for an exact FromPort=0/ToPort=65535 range or an all-protocols (-1) rule; any other public-ingress range is enumerated into public_ingress_ports: fully for ranges up to 1024 ports wide, and (regardless of width) always including any sensitive port (22/3389/3306/5432/1433/27017/6379/9200) enclosed by the range, plus the two range boundaries for wider ranges. This closes a prior gap where a wide-but-not-full public range (e.g. 1-65535 written without the exact sentinel, or an app range like 2000-4000) recorded only its boundary ports and could silently miss an enclosed sensitive port. Abstains fail-closed when the discoverer could not read the rules (both keys omitted).

## Why this rule carries no dollar saving

$0 (governance/compliance, no direct cost impact)

## Locking the inbound rules down

1. Go to EC2 Console → Security Groups → select the security group → Inbound rules
2. Identify rules with source 0.0.0.0/0 or ::/0
3. Replace 0.0.0.0/0 with specific IP ranges (your office CIDR, VPN CIDR, or specific service IPs)
4. For services that must be publicly accessible, restrict to specific ports only (e.g., 443 for HTTPS)
5. Use AWS Systems Manager Session Manager instead of opening SSH (port 22) to the internet
6. Consider placing resources in private subnets behind a load balancer

## Port evidence instead of a metric series

None (gate: per-port public_ingress_ports from discoverer; fires on 0.0.0.0/0 to a sensitive port (22/3389/3306/5432/1433/27017/6379/9200) or all-ports; abstains fail-closed on no port evidence). $0 security, no savings