Back to Checks
aws

VPC default security group has no inbound or outbound rules

ec2_securitygroup_default_restrict_traffic
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:trust-boundariesinternet-exposed
Resource Type:AwsEc2SecurityGroup

Default VPC security group should have no inbound or outbound rules. This evaluates whether the group allows any traffic-ingress, egress, or self-referencing-instead of remaining empty.

Prowler logoProwlerprowler-provider-aws

Risk

Permissive rules in the default security group mean instances that inherit it can communicate widely. This enables lateral movement, port scanning, and data exfiltration; unrestricted egress aids C2. Confidentiality and integrity are reduced, and the blast radius of a compromise grows.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_securitygroup_default_restrict_traffic

Recommendation

Enforce least privilege: keep the default group empty by removing all ingress and egress rules. Use dedicated security groups per workload with explicit sources, destinations, and ports. Regularly review for broad CIDRs like 0.0.0.0/0 and apply defense in depth via automation and policy guardrails.

Remediation

Terraform

resource "aws_default_security_group" "<example_resource_name>" {
  vpc_id = "<example_vpc_id>"

  ingress = []  # Critical: removes all inbound rules from the default SG
  egress  = []  # Critical: removes all outbound rules from the default SG
}

Other

1Open the AWS Console and go to VPC > Security > Security groups
2Select the security group named "default" for the affected VPC
3In Inbound rules, click Edit inbound rules, delete all rules, and Save
4In Outbound rules, click Edit outbound rules, delete all rules, and Save
5Repeat for each VPC that has this finding

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_securitygroup_default_restrict_traffic(Check):
    def execute(self):
        findings = []
        for security_group_arn, security_group in ec2_client.security_groups.items():
            # Check if ignoring flag is set and if the VPC and the default SG are in used
            if security_group.name == "default" and (
                ec2_client.provider.scan_unused_services
                or (
                    security_group.vpc_id in vpc_client.vpcs
                    and vpc_client.vpcs[security_group.vpc_id].in_use
                    and len(security_group.network_interfaces) > 0
                )
            ):
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=security_group
                )
                report.resource_details = security_group.name
                report.status = "FAIL"
                report.status_extended = (
                    f"Default Security Group ({security_group.id}) rules allow traffic."
                )
                if not security_group.ingress_rules and not security_group.egress_rules:
                    report.status = "PASS"
                    report.status_extended = f"Default Security Group ({security_group.id}) rules do not allow traffic."

                findings.append(report)

        return findings

References