Back to Checks
huaweicloud

VPC security groups should not allow ingress from 0.0.0.0/0 on all ports/protocols

vpc_security_group_all_protocols_open
Service: vpcSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that Virtual Private Cloud (VPC) security groups do not have ingress rules that allow all protocols from 0.0.0.0/0 (i.e., rules with no port range specified).

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Security group rules that allow all protocols from 0.0.0.0/0 expose the associated resources to unrestricted inbound traffic on every port, significantly increasing the attack surface.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks vpc_security_group_all_protocols_open

Recommendation

Replace any ingress rule allowing all protocols from 0.0.0.0/0 with specific port and IP range restrictions following least-privilege principles.

Remediation

CLI

hcloud VPC DeleteSecurityGroupRule --security_group_rule_id=<rule_id>

Other

1Log on to the **Huawei Cloud** console
2Navigate to **Virtual Private Cloud** > **Access Control** > **Security Groups**
3Select the **security group**
4Identify the `ingress` rule allowing all protocols from `0.0.0.0/0`
5Delete or restrict the rule to specific ports and IP ranges

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.vpc.vpc_client import vpc_client
from prowler.providers.huaweicloud.services.vpc.vpc_service import (
    rule_covers_all_ports,
    rule_source_is_open,
)


class vpc_security_group_all_protocols_open(Check):
    """Check if VPC security groups allow all protocols (any port) from 0.0.0.0/0 on ingress."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for sg in vpc_client.security_groups.values():
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=sg)
            report.region = sg.region
            report.resource_id = sg.id
            report.resource_arn = f"huaweicloud:vpc:{sg.region}:{vpc_client.audited_account}:security-group/{sg.id}"

            all_protocol_rules = [
                rule
                for rule in sg.rules
                if rule.direction == "ingress"
                and rule_source_is_open(rule)
                and rule_covers_all_ports(rule)
            ]

            if all_protocol_rules:
                report.status = "FAIL"
                report.status_extended = (
                    f"Security group {sg.name} ({sg.id}) allows ingress from 0.0.0.0/0 on all ports/protocols "
                    f"({len(all_protocol_rules)} rule(s))."
                )
            else:
                report.status = "PASS"
                report.status_extended = f"Security group {sg.name} ({sg.id}) does not allow ingress from 0.0.0.0/0 on all ports/protocols."

            findings.append(report)

        return findings

References