AWS Security Group Open To The World

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•29

This rule detects when an AWS security group ingress rule is modified to allow traffic from any IP address (0.0.0.0/0 for IPv4 or ::/0 for IPv6). This action, captured via AWS CloudTrail's AuthorizeSecurityGroupIngress event, significantly increases the attack surface of associated resources by making them accessible from the entire internet.