Back to Checks
aws

Security group not created using the EC2 Launch Wizard

ec2_securitygroup_from_launch_wizard
Service: ec2Severity: medium
OfficialBuilt-inVerified
Resource Type:AwsEc2SecurityGroup

EC2 security groups whose names include launch-wizard are identified as created by the EC2 Launch Wizard, distinguishing auto-generated groups from curated, baseline-controlled groups.

Prowler logoProwlerprowler-provider-aws

Risk

Wizard-generated groups often include overly permissive rules (e.g., 0.0.0.0/0 to admin ports), expanding exposure. Attackers can run port scans and brute-force to gain entry, then lateral movement and data exfiltration, impacting confidentiality and integrity; broad egress aids command-and-control.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_securitygroup_from_launch_wizard

Recommendation

Replace or harden these groups. Apply least privilege: restrict inbound to required sources, avoid public admin ports, and minimize egress. Use approved baseline security groups, enforce change control with IaC and guardrails, prefer private administration (bastion or Session Manager), and remove unused rules.

Remediation

CLI

aws ec2 delete-security-group --group-id <SECURITY_GROUP_ID>

Terraform

# Create a security group not named by Launch Wizard
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"  # Critical: name does NOT contain "launch-wizard" to avoid FAIL
  vpc_id = "<example_resource_id>"
}

NativeIaC

# CloudFormation: create a security group not named by Launch Wizard
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG not created by Launch Wizard
      VpcId: <example_resource_id>
      GroupName: <example_resource_name>  # Critical: name does NOT contain "launch-wizard" to avoid FAIL

Other

1In the AWS console, go to EC2 > Network & Security > Security Groups
2In the search box, filter by Name contains "launch-wizard"
3For each matching group, open the References tab and remove it from any ENIs/instances by replacing it with a different security group
4Select the launch-wizard security group and choose Actions > Delete security group > Delete
5Verify no security groups remain with names containing "launch-wizard"

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_securitygroup_from_launch_wizard(Check):
    def execute(self):
        findings = []
        for security_group in ec2_client.security_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=security_group)
            report.resource_details = security_group.name
            report.status = "PASS"
            report.status_extended = f"Security group {security_group.name} ({security_group.id}) was not created using the EC2 Launch Wizard."
            if "launch-wizard" in security_group.name:
                report.status = "FAIL"
                report.status_extended = f"Security group {security_group.name} ({security_group.id}) was created using the EC2 Launch Wizard."

            findings.append(report)

        return findings

References