Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Virtual Private Cloud/ SSH Check
Updated on 2024-11-12 GMT+08:00
View PDF
Share

SSH Check

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

vpc-sg-restricted-ssh

Identifier

vpc-sg-restricted-ssh

Description

If a security group allows all inbound traffic (with the source address set to 0.0.0.0/0 or ::/0) and opens the TCP 22 port, this security group is noncompliant.

Tag

vpc

Trigger Type

Configuration change

Filter Type

vpc.securityGroups

Configure Rule Parameters

None

Rule Logic

  • If a security group does not allow all IPv4 and IPv6 traffic (with the source address set to 0.0.0.0/0 or ::/0) to the TCP port 22, this security group is compliant.
  • If a security group allows all IPv4 and IPv6 traffic (with the source address set to 0.0.0.0/0 or ::/0) to the TCP port 22, this security group is noncompliant.

A security group typically contains multiple rules, and these rules follow a certain order to take effect. For details, see How Traffic Matches Security Group Rules. This Config rule bypasses all Deny rules. If any Allow rule is detected, the security group which the rule belongs to will be considered noncompliant.

Parent topic: Virtual Private Cloud