Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Virtual Private Cloud/ Port Check
Updated on 2024-11-12 GMT+08:00
View PDF
Share

Port Check

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

vpc-sg-ports-check

Identifier

vpc-sg-ports-check

Description

If a security group allows all inbound traffic (Source: 0.0.0.0/0) and opens all TCP/UDP ports, this security group is noncompliant.

Tag

vpc

Trigger Type

Configuration change

Filter Type

vpc.securityGroups

Configure Rule Parameters

None

Rule Logic

  • If a security group does not have the source address set to 0.0.0.0/0 or ::/0, or does not open all TCP/UDP ports, this security group is compliant.
  • If a security group has the source address set to 0.0.0.0/0 or ::/0 and opens all TCP/UDP ports, this security group is noncompliant.

A security group typically contains multiple rules, and these rules follow a certain order to take effect. For details, see How Traffic Matches Security Group Rules. This Config rule bypasses all Deny rules. If any Allow rule is detected, the security group which the rule belongs to will be considered noncompliant.

Parent topic: Virtual Private Cloud