Security group open to 0.0.0.0/0
SSH open to the entire internet — the classic copy-paste ingress rule.
Press Run. The stack loaded here fails in a way worth seeing.
▸What the engine finds3 findings
Not examples — Security group open to 0.0.0.0/0 was run through the real engine when this page was built, and this is what it returned.
Port 22 is open to the whole internet. Scope it to a known CIDR.INTENT
▸ 2 informational findings — security group open, vpc has no
Security group open to the internetAwsSolutions-EC23BastionSg
This port is open to the entire internet, not to a network you control. It will be found by automated scanners within minutes of going live.
Full rule text
The Security Group allows for 0.0.0.0/0 or ::/0 inbound access. Large port ranges, when open, expose instances to unwanted attacks. More than that, they make traceability of vulnerabilities very difficult. For instance, your web servers may only require 80 and 443 ports to be open, but not all. One of the most common mistakes observed is when all ports for 0.0.0.0/0 range are open in a rush to access the instance. EC2 instances must expose only to those ports enabled on the corresponding security group level. AwsSolutions-EC23 guide →
VPC has no flow logsAwsSolutions-VPC7Vpc
With no flow logs there is no record of network traffic, so a connection you did not expect leaves no trace to find later.
Full rule text
The VPC does not have an associated Flow Log. VPC Flow Logs capture network flow information for a VPC, subnet, or network interface and stores it in Amazon CloudWatch Logs. Flow log data can help customers troubleshoot network issues; for example, to diagnose why specific traffic is not reaching an instance, which might be a result of overly restrictive security group rules. AwsSolutions-VPC7 guide →
Go deeper
Everything this preset trips, mapped to where it’s actually taught.
This is one failure mode. The course teaches the pattern.
The EC2 track walks it checkpoint by checkpoint, graded by the same engine that just ran your code.
Start the EC2 track — first checkpoint free →Or start from a stack that fails interestingly
The single most common AI-generated CDK mistake: a bucket left open to the world.
SSH open to the entire internet — the classic copy-paste ingress rule.
Website hosting straight off a bucket — no CDN, no TLS, no access logging.
A database with storage encryption off and backups barely configured.
Action "*" on Resource "*" — the permission grant that ends incident reviews.
A REST API wired to Lambda, wide open, with no access logging.
Fast to write, impossible to restore — no PITR, no encryption choice.
A CDN that will happily serve your site unencrypted, with no logging.
A queue with no server-side encryption and no dead-letter queue.
Network traffic no one can reconstruct after the fact.
Six characters, no symbols, no MFA — defaults nobody revisited.
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.