Security group has overlapping CIDR rules

What this check finds

Two rules in this security group cover overlapping address ranges. This often happens when one attempts to restrict access, then opens up the access further, leaving the narrower rule with no effect.

Passing looks like: No overlapping security group CIDRs.

How to fix it

Review inbound rules for overlapping CIDRs and consolidate them. Remove the more permissive rule if it supersedes the restrictive one.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Security groups checks

• CriticalSecurity group has critical port open to the internet
• HighDefault VPC security group allows unrestricted traffic
• InfoSecurity Group CIDR contains large IP range
• InfoSecurity group CIDR is formatted unexpectedly
• InfoSecurity group contains a redundant CIDR rule

All Security groups checks