Courses Quizzes Articles Tools Contact
Login

Tools

Security group rule checker

Paste the inbound rules of a security group. The checker flags what is open to the internet, ports that should not be, and rules that repeat or add nothing. The text is read on the server and is not saved.

One rule per line as type ports source, such as SSH 22 10.0.0.0/8 or tcp 8000 sg-…. Or paste the JSON from aws ec2 describe-security-groups. Only inbound rules are read.

Load an example

How to enter rules

One rule per line. A # starts a comment.

SSH 22 0.0.0.0/0
HTTPS 0.0.0.0/0
tcp 8000-8100 10.0.1.0/24
tcp 5432 sg-0a1b2c3d4e5f67890
udp 53 pl-0a1b2c3d
icmp 10.0.0.0/16
all 10.0.0.0/16
  • Protocol: tcp and udp take a port or a range such as 8000-8100 (or all). icmp, icmpv6, and all take no port.
  • Service names: the first word can also be a type from the AWS console, such as SSH, HTTPS, RDP, PostgreSQL, or MySQL/Aurora. These are not protocols of their own. Each one stands for TCP on its usual port, so SSH 22 0.0.0.0/0 and SSH 0.0.0.0/0 mean the same thing. To allow HTTP/3, which uses UDP, write udp 443 ….
  • Source: a CIDR block, a security group ID (sg-…), or a prefix list ID (pl-…). 0.0.0.0/0 is every IPv4 address and ::/0 is every IPv6 address. A single address such as 203.0.113.5 is read as a /32.
  • From the AWS CLI: run aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 and paste the output. Several groups are checked together and each finding names its group.

What the checker looks for

Everything open to the internet high
All protocols, or every port from 0 to 65535, open to 0.0.0.0/0 or ::/0.
Sensitive port open to the internet high
SSH (22), Telnet, RDP (3389), VNC, SMB, NFS, and common database and cache ports (PostgreSQL 5432, MySQL 3306, SQL Server, Oracle, MongoDB, Redis, Memcached, Elasticsearch) open to the whole internet.
Port open to the internet medium low
Any other port open to everyone. Ports 80 and 443 are reported as low, because a public web tier is expected to be open. Whether a medium finding is a problem depends on what the group is for.
Wide port range medium low
More than 100 ports in one rule. Medium when the source is the whole internet, low otherwise.
Broad private range low
A private range of /16 or larger on a sensitive port. It allows every current and future address in that range, not only the app that needs access.
Duplicate rule and rule already covered low
The same rule twice, or a narrow rule that a wider one already allows. Security groups only allow, so the narrow rule changes nothing.

What to do instead

  • SSH and RDP. Allow only your own address as a /32, or use AWS Systems Manager Session Manager, which needs no inbound port at all.
  • Databases. Allow the port from the security group of the app that connects, not from a CIDR. A replacement instance in the same group is allowed automatically, and nothing else in the VPC is.
  • Web traffic. Open 80 and 443 on the load balancer's group. Let the app's group accept its port only from the load balancer's group.

Security groups are allow-lists. If no rule matches, the packet is dropped, and there are no deny rules. Return traffic for a connection you allowed is permitted automatically, so you never open a port for responses.

What the checker cannot see

  • What the group is attached to. An open rule on an instance with no public address and no route from an internet gateway is less exposed than the same rule on a public one.
  • Network ACLs, route tables, and other security groups on the same interface.
  • Who is in a referenced security group or a prefix list.

Treat a clean result as "no known bad pattern in these rules", not as a security review.

Related lessons