Default sg unrestricted remediation

Using Console

Below are concise, console-based steps to remediate “Default Security Groups allow unrestricted inbound access” in AWS.

1. Identify default security groups with open inbound access

Sign in to the AWS Management Console.
Go to EC2.
In the left navigation pane, choose Security Groups.
In the filter/search bar, type default and press Enter.
In the Group Name column, look for security groups named default (one per VPC).
For each default SG:
- Select it and check the Inbound rules tab.
- Look for rules with:
  - Type = All traffic, All ICMP, SSH, RDP, Custom TCP/UDP, etc.
  - Source = 0.0.0.0/0 and/or ::/0 (unrestricted).

2. Remove unrestricted inbound rules on the default security group

For each default security group that has 0.0.0.0/0 or ::/0 in inbound rules:

Select the default security group.
Choose the Inbound rules tab.
Click Edit inbound rules.
For each rule where:
- Source is 0.0.0.0/0 or ::/0, and
- It is not needed for VPC-internal communication:
  - Click the X at the end of the row to remove it.
Make sure that if you need instances in the same security group to talk to each other, you keep (or add) a rule like:
- Type: All traffic (or the specific required ports)
- Protocol: All (or needed)
- Port range: All (or needed)
- Source: The security group itself (select from dropdown under Custom → SG ID).
Click Save rules.

Note: You cannot delete a default security group, only modify its rules.

3. Create and use dedicated security groups for external access

To avoid using the default SG for internet-exposed services:

In Security Groups, click Create security group.
Enter:
- Security group name: e.g., web-servers-sg.
- Description: e.g., Security group for public web servers (HTTP/HTTPS only).
- VPC: Select the correct VPC.
Under Inbound rules, add only what’s needed, with limited source ranges, for example:
- Rule 1:
  - Type: HTTP
  - Port: 80
  - Source: Your office IP /32 or specific CIDR (not 0.0.0.0/0 if possible).
- Rule 2:
  - Type: HTTPS
  - Port: 443
  - Source: As above.
- For SSH/RDP, use:
  - Type: SSH / RDP
  - Source: Admin IPs only (never 0.0.0.0/0).
Click Create security group.

Attach this new SG to instances instead of using the default:

Go to Instances.
Select the instance currently using the default security group.
Choose Actions → Security → Change security groups.
Check your new SG (e.g., web-servers-sg) and uncheck the default SG (if safe to do so).
Click Apply.

4. Confirm remediation

Return to Security Groups.
For each default SG:
- Confirm there are no inbound rules with 0.0.0.0/0 or ::/0.
Optionally, use Reachability Analyzer or test from the internet to ensure ports are no longer globally open.

This ensures default security groups no longer allow unrestricted inbound access while preserving required internal communication and moving internet exposure to dedicated, controlled security groups.

Using CLI

Below is a concise, CLI‑only way to lock down default Security Groups so they don’t allow unrestricted inbound (0.0.0.0/0 or ::/0).

1. Identify default Security Groups that allow unrestricted inbound

# Example region; change as needed
REGION=us-east-1

aws ec2 describe-security-groups \
  --region "$REGION" \
  --filters "Name=group-name,Values=default" \
  --query "SecurityGroups[].[GroupId,GroupName,VpcId,IpPermissions]" \
  --output json

Look for:

IpRanges with CidrIp: "0.0.0.0/0"
Ipv6Ranges with CidrIpv6: "::/0"

These are the rules to remove.

2. Revoke all inbound rules on default Security Groups (safer baseline)

If you’re okay with removing all inbound rules from all default SGs in a region:

REGION=us-east-1

for SG in $(aws ec2 describe-security-groups \
  --region "$REGION" \
  --filters "Name=group-name,Values=default" \
  --query "SecurityGroups[].GroupId" \
  --output text); do

  # Get IpPermissions as JSON
  IP_PERMS=$(aws ec2 describe-security-groups \
    --region "$REGION" \
    --group-ids "$SG" \
    --query "SecurityGroups[0].IpPermissions" \
    --output json)

  # If there are any inbound rules, revoke them all
  if [ "$IP_PERMS" != "[]" ]; then
    echo "Revoking all inbound rules on $SG"
    aws ec2 revoke-security-group-ingress \
      --region "$REGION" \
      --group-id "$SG" \
      --ip-permissions "$IP_PERMS"
  fi
done

This ensures the default SG has no inbound rules (i.e., nothing is allowed in).

3. (Optional) Only remove “unrestricted” inbound rules

If you want to keep other, more restricted rules and only remove 0.0.0.0/0 or ::/0, you need to filter the permissions. One straightforward approach is to manually revoke specific rules once you’ve inspected them.Example: remove a specific inbound rule (TCP 22 from 0.0.0.0/0) from a known default SG:

SG_ID=sg-xxxxxxxxxxxxxxxx
REGION=us-east-1

aws ec2 revoke-security-group-ingress \
  --region "$REGION" \
  --group-id "$SG_ID" \
  --ip-permissions '[
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "IpRanges": [{"CidrIp": "0.0.0.0/0"}]
    }
  ]'

Similarly for IPv6:

aws ec2 revoke-security-group-ingress \
  --region "$REGION" \
  --group-id "$SG_ID" \
  --ip-permissions '[
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "Ipv6Ranges": [{"CidrIpv6": "::/0"}]
    }
  ]'

Repeat for each protocol/port combination you find with unrestricted access.

4. (Optional) Add safer, restricted inbound rules

After cleanup, if you need access from a known IP/CIDR:

SG_ID=sg-xxxxxxxxxxxxxxxx
REGION=us-east-1
MY_IP_CIDR="203.0.113.10/32"   # replace with your IP/CIDR

aws ec2 authorize-security-group-ingress \
  --region "$REGION" \
  --group-id "$SG_ID" \
  --ip-permissions "[
    {
      \"IpProtocol\": \"tcp\",
      \"FromPort\": 22,
      \"ToPort\": 22,
      \"IpRanges\": [{\"CidrIp\": \"$MY_IP_CIDR\", \"Description\": \"SSH from admin\"}]
    }
  ]"

This leaves the default Security Groups without any 0.0.0.0/0 or ::/0 inbound access.

Using Python

Below is one straightforward way to remediate this using Python and boto3: identify default security groups that allow 0.0.0.0/0 or ::/0 inbound, then remove those rules.

1. Prerequisites

Install boto3:
pip install boto3
Configure AWS credentials with sufficient permissions:
- ec2:DescribeSecurityGroups
- ec2:RevokeSecurityGroupIngress
For example:
aws configure

2. Python script to remove unrestricted inbound from default security groups

This script:

Enumerates all regions.
Finds default security groups.
Detects inbound rules with:
- IPv4: 0.0.0.0/0
- IPv6: ::/0
Revokes only those offending rules (leaves other rules intact).

import boto3

def get_all_regions():
    ec2 = boto3.client("ec2")
    regions = ec2.describe_regions(AllRegions=False)["Regions"]
    return [r["RegionName"] for r in regions]

def remove_unrestricted_inbound_from_default_sg(region):
    ec2 = boto3.client("ec2", region_name=region)

    # Get all default security groups in this region
    response = ec2.describe_security_groups(
        Filters=[{"Name": "group-name", "Values": ["default"]}]
    )
    sgs = response.get("SecurityGroups", [])

    for sg in sgs:
        group_id = sg["GroupId"]
        group_name = sg["GroupName"]
        vpc_id = sg.get("VpcId")

        print(f"Checking SG {group_id} ({group_name}) in VPC {vpc_id} in {region}")

        # Build list of offending ingress rules to revoke
        permissions_to_revoke = []

        for perm in sg.get("IpPermissions", []):
            # Copy the permission skeleton
            perm_to_revoke = {
                "IpProtocol": perm["IpProtocol"],
                "FromPort": perm.get("FromPort"),
                "ToPort": perm.get("ToPort"),
                "UserIdGroupPairs": [],
                "IpRanges": [],
                "Ipv6Ranges": [],
                "PrefixListIds": perm.get("PrefixListIds", [])
            }

            # Check IPv4 ranges
            for ip_range in perm.get("IpRanges", []):
                if ip_range.get("CidrIp") == "0.0.0.0/0":
                    perm_to_revoke["IpRanges"].append(ip_range)

            # Check IPv6 ranges
            for ipv6_range in perm.get("Ipv6Ranges", []):
                if ipv6_range.get("CidrIpv6") == "::/0":
                    perm_to_revoke["Ipv6Ranges"].append(ipv6_range)

            # Only add permission if we actually found something to revoke
            if perm_to_revoke["IpRanges"] or perm_to_revoke["Ipv6Ranges"]:
                permissions_to_revoke.append(perm_to_revoke)

        # Revoke offending rules if any
        if permissions_to_revoke:
            print(f"Revoking unrestricted inbound rules from {group_id} in {region}")
            ec2.revoke_security_group_ingress(
                GroupId=group_id,
                IpPermissions=permissions_to_revoke
            )
        else:
            print(f"No unrestricted inbound on {group_id} in {region}")

def main():
    regions = get_all_regions()
    for region in regions:
        print(f"\n=== Region: {region} ===")
        remove_unrestricted_inbound_from_default_sg(region)

if __name__ == "__main__":
    main()

3. Notes / Adjustments

If you only want to operate in a single region, replace get_all_regions() with a hard-coded list, e.g. regions = ["us-east-1"].
This script only removes the 0.0.0.0/0 or ::/0 inbound rules. It does not add replacement rules; if you need specific allowed CIDRs, add them explicitly with authorize_security_group_ingress.

Using Terraform

# Remediate the default security group so it does NOT allow unrestricted inbound access.
# Replace VPC_ID with the ID of the VPC whose default security group you are managing.

resource "aws_default_security_group" "this" {
  vpc_id = "VPC_ID"  # e.g. aws_vpc.main.id

  # Remove all default ingress rules (no inbound allowed by default)
  ingress = []

  # Option 1: allow all outbound (common default)
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  # OR Option 2: restrict outbound to specific destinations/ports instead of 0.0.0.0/0
  # egress {
  #   from_port   = 443
  #   to_port     = 443
  #   protocol    = "tcp"
  #   cidr_blocks = ["ALLOWED_CIDR"]
  # }
}

This change updates the in‑place default security group (no replacement is forced, but rules will be revoked and recreated as needed).Verification: terraform plan should show the aws_default_security_group ingress rules from 0.0.0.0/0 (and/or ::/0) being removed and no new unrestricted inbound rules added.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Default sg unrestricted remediation

Triage and Remediation

Remediation

1. Identify default security groups with open inbound access

2. Remove unrestricted inbound rules on the default security group

3. Create and use dedicated security groups for external access

4. Confirm remediation

1. Identify default Security Groups that allow unrestricted inbound

2. Revoke all inbound rules on default Security Groups (safer baseline)

3. (Optional) Only remove “unrestricted” inbound rules

4. (Optional) Add safer, restricted inbound rules

1. Prerequisites

2. Python script to remove unrestricted inbound from default security groups

3. Notes / Adjustments

​Triage and Remediation

​Remediation

​1. Identify default security groups with open inbound access

​2. Remove unrestricted inbound rules on the default security group

​3. Create and use dedicated security groups for external access

​4. Confirm remediation

​1. Identify default Security Groups that allow unrestricted inbound

​2. Revoke all inbound rules on default Security Groups (safer baseline)

​3. (Optional) Only remove “unrestricted” inbound rules

​4. (Optional) Add safer, restricted inbound rules

​1. Prerequisites

​2. Python script to remove unrestricted inbound from default security groups

​3. Notes / Adjustments

Triage and Remediation

Remediation

1. Identify default security groups with open inbound access

2. Remove unrestricted inbound rules on the default security group

3. Create and use dedicated security groups for external access

4. Confirm remediation

1. Identify default Security Groups that allow unrestricted inbound

2. Revoke all inbound rules on default Security Groups (safer baseline)

3. (Optional) Only remove “unrestricted” inbound rules

4. (Optional) Add safer, restricted inbound rules

1. Prerequisites

2. Python script to remove unrestricted inbound from default security groups

3. Notes / Adjustments