Back to Checks
aws

Security group does not have all ports open to the Internet

ec2_securitygroup_allow_ingress_from_internet_to_all_ports
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2SecurityGroup

EC2 security groups with inbound rules permitting Internet sources (0.0.0.0/0, ::/0) to all ports across any protocol

Prowler logoProwlerprowler-provider-aws

Risk

Opening every port to the Internet enables broad scanning and exploit attempts, leading to unauthorized access, remote code execution, and data exfiltration, with easier lateral movement into the VPC. Confidentiality, integrity, and availability are all at risk.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_all_ports

Recommendation

Enforce least privilege on ingress: allow only required ports from trusted sources, avoid 0.0.0.0/0 and ::/0. Prefer private access (VPN, bastion, or Session Manager), use security group references, and layer defense in depth with network ACLs. Periodically review and remove unused rules.

Remediation

Terraform

# Security Group with no inbound rules (prevents all ports open to the Internet)
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  # Critical: no ingress blocks; avoids any rule with protocol "-1" from 0.0.0.0/0 or ::/0
}

NativeIaC

# CloudFormation: Security Group without an inbound rule that opens all ports to the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Example SG
      VpcId: <example_resource_id>
      # Critical: Omit SecurityGroupIngress to ensure no rule with IpProtocol "-1" from 0.0.0.0/0 or ::/0 exists,
      # which prevents all ports from being open to the Internet.

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the affected security group
3Open the Inbound rules tab and click Edit inbound rules
4Delete any rule where Type is All traffic (protocol = All) with Source 0.0.0.0/0 or ::/0
5Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS, Severity
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_securitygroup_allow_ingress_from_internet_to_all_ports(Check):
    def execute(self):
        findings = []
        for security_group_arn, security_group in ec2_client.security_groups.items():
            # Check if ignoring flag is set and if the VPC and the SG is in use
            sg_in_use = (
                security_group.vpc_id in vpc_client.vpcs
                and vpc_client.vpcs[security_group.vpc_id].in_use
                and len(security_group.network_interfaces) > 0
            )
            if ec2_client.provider.scan_unused_services or sg_in_use:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=security_group
                )
                if not sg_in_use:
                    report.check_metadata.Severity = Severity.high
                report.resource_details = security_group.name
                report.status = "PASS"
                report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have all ports open to the Internet."

                for ingress_rule in security_group.ingress_rules:
                    if check_security_group(ingress_rule, "-1", any_address=True):
                        ec2_client.set_failed_check(
                            self.__class__.__name__,
                            security_group_arn,
                        )
                        report.status = "FAIL"
                        report.status_extended = f"Security group {security_group.name} ({security_group.id}) has all ports open to the Internet."
                        break

                findings.append(report)

        return findings

References