Access Control Check for Non-whitelisted Ports

Rule Details

**Table 1** Rule details
Parameter	Description
Rule Name	vpc-sg-by-white-list-ports-check
Identifier	vpc-sg-by-white-list-ports-check
Description	If a security group allows traffic to a non-whitelisted port, this security group is noncompliant.
Tag	vpc
Trigger Type	Configuration change
Filter Type	vpc.securityGroups
Rule Parameter	whiteListPorts: whitelisted ports

Rule Logic

If a security group denies both inbound and outbound traffic to all non-whitelisted ports, this security group is compliant.
If a security group allows traffic to any non-whitelisted port, this security group is noncompliant.

A security group typically contains multiple rules, and these rules follow a certain order to take effect. For details, see How Traffic Matches Security Group Rules. This Config rule bypasses all Deny rules. If any Allow rule is detected, the security group which the rule belongs to will be considered noncompliant.

Parent topic: Virtual Private Cloud

Previous topic: SSH Check

Next topic: A Security Group is Attached to Elastic Network Interfaces