AwsSolutions-EC23

Security group allows 0.0.0.0/0 inbound

What it means

A security group ingress rule permits traffic from any address on the internet.

Why it matters

Open SSH and RDP ports are found by automated scanners within minutes of a security group going live — not eventually, minutes. The rule is usually added to unblock something during setup and then never narrowed, because nothing about it fails.

How to fix it

Scope the rule to a known CIDR or another security group. For administrative access prefer AWS Systems Manager Session Manager, which needs no inbound rule at all.

See it fail

This stack trips AwsSolutions-EC23 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.

Open “Security group open to 0.0.0.0/0” in the playground →
Learn it properly
Learn to open a security group without opening it to everyone

A graded checkpoint on exactly this decision — you write the CDK, the same engine marks it.

Start the checkpoint · 12 min →

Other rules