Default Security Group Check

Rule Details

Rule Logic

• All non-default security groups are compliant.
• If a default security group denies all inbound or outbound traffic, it is considered compliant.
• If a default security group allows any inbound or outbound traffic, it is considered noncompliant.

A security group typically contains multiple rules, and these rules follow a certain order to take effect. For details, see How Traffic Matches Security Group Rules. This Config rule bypasses all Deny rules. If any Allow rule is detected, the security group which the rule belongs to will be considered noncompliant.