Back to Checks
aws

Security group has 50 or fewer inbound rules and 50 or fewer outbound rules

ec2_securitygroup_with_many_ingress_egress_rules
Service: ec2Severity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:AwsEc2SecurityGroup

EC2 security groups are evaluated for excessive rule counts, flagging groups where ingress or egress entries exceed the configured threshold (default 50). This targets groups with unusually large rule sets that complicate access control.

Prowler logoProwlerprowler-provider-aws

Risk

Rule sprawl weakens least privilege: large rule sets can hide overly permissive entries, exposing services to the Internet or unintended peers. This enables unauthorized access, data exfiltration, and lateral movement, impacting confidentiality and integrity, and can threaten availability via abuse of exposed services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_securitygroup_with_many_ingress_egress_rules

Recommendation

Apply least privilege and segmentation:

  • Limit rules to required ports, protocols, and sources
  • Split workloads into dedicated security groups per role
  • Prefer SG-to-SG references over broad CIDRs
  • Regularly review, deduplicate, and remove stale rules
  • Layer controls (NACLs, private endpoints) for defense in depth

Remediation

Terraform

# Terraform: Security group with limited number of rules
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {                      # Critical: keep total ingress/egress rules  50; single rule ensures PASS
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

NativeIaC

# CloudFormation: Security group with limited number of rules
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "<example_resource_name>"
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 10.0.0.0/8  # Critical: keep total inbound rules  50; this example defines only 1 rule to ensure compliance

Other

1In the AWS console, go to EC2 > Security Groups
2Select the security group that FAILED
3In Inbound rules, click Edit inbound rules
4Delete rules until the inbound rule count is 50 or fewer, then Save
5In Outbound rules, click Edit outbound rules
6Delete rules until the outbound rule count is 50 or fewer, then Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_securitygroup_with_many_ingress_egress_rules(Check):
    def execute(self):
        findings = []

        # max_security_group_rules, default: 50
        max_security_group_rules = ec2_client.audit_config.get(
            "max_security_group_rules", 50
        )
        for security_group_arn, security_group in ec2_client.security_groups.items():
            report = Check_Report_AWS(metadata=self.metadata(), resource=security_group)
            report.resource_details = security_group.name
            report.status = "PASS"
            report.status_extended = f"Security group {security_group.name} ({security_group.id}) has {len(security_group.ingress_rules)} inbound rules and {len(security_group.egress_rules)} outbound rules."
            if (
                len(security_group.ingress_rules) > max_security_group_rules
                or len(security_group.egress_rules) > max_security_group_rules
            ):
                report.status = "FAIL"
            findings.append(report)

        return findings

References