Back to Checks
huaweicloud

VPC security groups do not allow open egress to the internet

vpc_security_group_open_egress
Service: vpcSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:HUAWEICLOUD::VPC::SecurityGroup

Security groups should not allow unrestricted egress to all destinations. Huawei Cloud represents unrestricted destinations as 0.0.0.0/0, ::/0, or an empty remote IP prefix without a remote security group or address group. Open egress allows instances to reach any destination on the internet, increasing the risk of data exfiltration and command-and-control communication.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Unrestricted egress rules allow instances to communicate with any external destination. This increases the risk of data exfiltration, unauthorized outbound connections, and command-and-control channel establishment by compromised instances.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks vpc_security_group_open_egress

Recommendation

Restrict allow egress rules to required destination IP ranges, security groups, or address groups instead of allowing all IPv4 or IPv6 destinations.

Remediation

CLI

hcloud VPC UpdateSecurityGroupRule --security_group_rule_id <rule_id> --remote_ip_prefix <restricted_cidr>

Other

1Log on to the Huawei Cloud console.
2Choose VPC.
3Click Security Groups.
4Select the security group.
5Edit each allow egress rule whose destination is 0.0.0.0/0, ::/0, or empty and unscoped.
6Restrict the destination to required IP ranges or an appropriate security group or address group.
7Click OK.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.vpc.vpc_client import vpc_client


class vpc_security_group_open_egress(Check):
    """Check if VPC security groups allow unrestricted egress to the internet."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        """Execute the unrestricted egress check.

        Returns:
            list[CheckReportHuaweiCloud]: Reports for the evaluated security groups.
        """
        findings = []

        for sg in vpc_client.security_groups.values():
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=sg)
            report.region = sg.region
            report.resource_id = sg.id
            report.resource_arn = (
                f"huaweicloud:vpc:{sg.region}:"
                f"{vpc_client.audited_account}:security-group/{sg.id}"
            )

            open_egress_destination = None
            for rule in sg.rules:
                if (
                    rule.direction != "egress"
                    or rule.action != "allow"
                    or rule.remote_group_id
                    or rule.remote_address_group_id
                ):
                    continue
                if rule.remote_ip_prefix in ("0.0.0.0/0", "::/0"):
                    open_egress_destination = rule.remote_ip_prefix
                    break
                if not rule.remote_ip_prefix:
                    open_egress_destination = "all destinations"
                    break

            if open_egress_destination:
                report.status = "FAIL"
                report.status_extended = (
                    f"Security group {sg.name} ({sg.id}) allows open egress "
                    f"({open_egress_destination}) to the internet."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Security group {sg.name} ({sg.id}) does not allow open egress "
                    f"to the internet."
                )

            findings.append(report)

        return findings

References