Back to Checks
huaweicloud

Default security groups restrict all traffic

vpc_default_security_group_restricts_all_traffic
Service: vpcSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that default security groups restrict all traffic to prevent unauthorized access to cloud resources.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Security groups with rules that allow open CIDR ranges (0.0.0.0/0 or ::/0) expose resources to traffic from any source on the internet. This significantly increases the attack surface and can lead to unauthorized access, data exfiltration, or service disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks vpc_default_security_group_restricts_all_traffic

Recommendation

Remove or restrict security group rules that allow traffic from open CIDR ranges (0.0.0.0/0 or ::/0). Default security groups should not allow unrestricted inbound or outbound traffic.

Remediation

CLI

hcloud VPC DeleteSecurityGroupRule --security_group_rule_id=<rule_id>

Other

1Log on to the **Huawei Cloud** console
2Navigate to **VPC** > **Security Groups**
3Select the **default security group**
4Review and delete any rules with `0.0.0.0/0` or `::/0` as the source/destination
5Add restrictive rules as needed

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.vpc.vpc_client import vpc_client
from prowler.providers.huaweicloud.services.vpc.vpc_service import (
    DEFAULT_SECURITY_GROUP_NAMES,
    rule_source_is_open,
)


class vpc_default_security_group_restricts_all_traffic(Check):
    """Check if the default security group restricts all traffic."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for sg in vpc_client.security_groups.values():
            if sg.name not in DEFAULT_SECURITY_GROUP_NAMES:
                continue

            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=sg)
            report.region = sg.region
            report.resource_id = sg.id
            report.resource_arn = f"huaweicloud:vpc:{sg.region}:{vpc_client.audited_account}:security-group/{sg.id}"

            open_directions = []
            for rule in sg.rules:
                if rule.direction not in ("ingress", "egress"):
                    continue
                if not rule_source_is_open(rule):
                    continue
                if rule.direction not in open_directions:
                    open_directions.append(rule.direction)

            if open_directions:
                report.status = "FAIL"
                report.status_extended = (
                    f"Default security group {sg.name} ({sg.id}) has "
                    f"{' and '.join(open_directions)} rule(s) open to any source."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Default security group {sg.name} ({sg.id}) does not "
                    "have any rule open to any source."
                )

            findings.append(report)

        return findings

References