Ensure Security Groups with All Inbound Public Traffic are Business-Approved


AWS Security Groups serve as virtual firewalls to regulate inbound and outbound traffic for associated resources. If a security group permits all inbound traffic from the public internet (, it creates a potential security vulnerability, exposing associated resources to potential attacks. While there are legitimate scenarios where specific resources might need to be accessible to the entire internet (e.g., a public website), such configurations should always be explicitly business-approved to ensure they are intentional and not the result of an oversight or misconfiguration.


1. Identify Security Groups with All Inbound Public Traffic:

AWS Management Console:
  • Navigate to the EC2 Dashboard.
  • In the left navigation pane, choose Security Groups.
  • Review the inbound rules for each security group, specifically looking for rules allowing access from

2. Verify Business Approval:

For each security group with broad public access:

  • Consult with the team or individual responsible for the resource associated with that security group.
  • Determine the business need for the open access.
  • If the broad access is business-approved, document the justification and approval.
  • If the open access is not justified or lacks proper approval, restrict access to only the necessary IP addresses or ranges.
AWS Management Console:
  • For the identified security group with broad public access, select the group.
  • Under the Inbound rules tab, choose Edit inbound rules.
  • Modify or remove the rule that allows all public traffic and save changes.

3. Implement Monitoring:

  • Regularly audit security groups for overly permissive inbound rules.
  • Use tools like AWS Config to set up rules that will alert you when security groups with broad public access are created or modified.
  • Establish a workflow for obtaining and documenting business approval for such configurations.


Always approach security group configurations with a principle of least privilege in mind. Even if a resource requires broad access, always ensure this is a conscious, documented decision backed by a valid business reason. Implementing regular audits, automated checks, and approval workflows can help maintain a secure AWS environment, reduce potential attack surfaces, and ensure adherence to security best practices.