Back to Checks
huaweicloud

ECS instances should not use the default security group

ecs_instance_no_default_security_group
Service: ecsSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that Elastic Cloud Server (ECS) instances do not use the default security group, which may have overly permissive rules.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

The default security group in Huawei Cloud may allow unrestricted traffic. Using it for ECS instances increases the risk of unauthorized network access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks ecs_instance_no_default_security_group

Recommendation

Create custom security groups with least-privilege rules and replace the default security group on all ECS instances.

Remediation

CLI

hcloud ECS NovaDisassociateSecurityGroup --server_id=<instance_id> --removeSecurityGroup.name="default"

Other

1Log on to the **Huawei Cloud** console
2Navigate to **Elastic Cloud Server**
3Select the instance
4Click **More** > **Manage Security Group**
5Remove the **default security group**
6Attach a custom **security group** with restrictive rules

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.ecs.ecs_client import ecs_client


class ecs_instance_no_default_security_group(Check):
    """Ensure ECS instances do not use the default security group."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for instance in ecs_client.instances.values():
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=instance)
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"huaweicloud:ecs:{instance.region}:{ecs_client.audited_account}:instance/{instance.id}"

            default_sgs = [
                sg_id
                for sg_id, sg_name in instance.security_groups.items()
                if sg_name == "default" or sg_id == "default"
            ]

            if default_sgs:
                report.status = "FAIL"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) uses the default security group: {', '.join(default_sgs)}."
            else:
                report.status = "PASS"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) does not use the default security group."

            findings.append(report)

        return findings

References