AwsSolutions-EC23
Security group allows 0.0.0.0/0 inbound
What it means
A security group ingress rule permits traffic from any address on the internet.
Why it matters
Open SSH and RDP ports are found by automated scanners within minutes of a security group going live — not eventually, minutes. The rule is usually added to unblock something during setup and then never narrowed, because nothing about it fails.
How to fix it
Scope the rule to a known CIDR or another security group. For administrative access prefer AWS Systems Manager Session Manager, which needs no inbound rule at all.
See it fail
This stack trips AwsSolutions-EC23 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.
Open “Security group open to 0.0.0.0/0” in the playground →Learn it properly
Learn to open a security group without opening it to everyone
A graded checkpoint on exactly this decision — you write the CDK, the same engine marks it.
Start the checkpoint · 12 min →