Security Group CIDR contains large IP range

What this check finds

The CIDR in a Security Group in the account contains a large IP range, defeating the purpose of restricting access with a Security Group.

Passing looks like: Security groups avoid large CIDR ranges.

How to fix it

Replace the large CIDR (e.g. 0.0.0.0/0) with a narrower IP range specific to your trusted sources. If this is for public-facing web traffic on 80/443, it may be acceptable. For management ports (22, 3389), restrict to known office IP ranges or use a VPN/bastion.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Security groups checks

• CriticalSecurity group has critical port open to the internet
• HighDefault VPC security group allows unrestricted traffic
• LowSecurity group has overlapping CIDR rules
• InfoSecurity group CIDR is formatted unexpectedly
• InfoSecurity group contains a redundant CIDR rule

All Security groups checks