Back to Checks
e2enetworks

E2E Networks security groups do not allow all traffic

securitygroup_no_all_traffic_rule
Service: securitygroupSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

E2E Networks security groups should not have an all-traffic rule, which permits unrestricted inbound and outbound network access.

Prowler logoProwlerprowler-provider-e2enetworks

Risk

Security groups that allow all traffic permit unrestricted network access, increasing exposure to lateral movement and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler e2enetworks --checks securitygroup_no_all_traffic_rule

Recommendation

Restrict security group rules to the required ports and sources only, removing any all-traffic rule.

Check Code

from prowler.lib.check.models import Check, CheckReportE2eNetworks
from prowler.providers.e2enetworks.services.securitygroup.securitygroup_client import (
    securitygroup_client,
)


class securitygroup_no_all_traffic_rule(Check):
    """Check that security groups do not allow all traffic."""

    def execute(self) -> list[CheckReportE2eNetworks]:
        findings = []
        for group in securitygroup_client.security_groups:
            report = CheckReportE2eNetworks(metadata=self.metadata(), resource=group)
            report.status = "PASS"
            report.status_extended = (
                f"Security group {group.name} does not allow all traffic."
            )
            if group.is_all_traffic_rule:
                report.status = "FAIL"
                report.status_extended = (
                    f"Security group {group.name} allows all traffic."
                )
            findings.append(report)
        return findings

References