VPC security groups and private access

Default deny, least ports, no public sprawl.

In short. IAM will not save you from an open security group. Network exposure is still how ransomware and cryptominers find admin panels.

IAM will not save you from an open security group. Network exposure is still how ransomware and cryptominers find admin panels. Security groups are stateful allow-lists: default deny inbound, only open what you must, prefer paths via load balancers and PrivateLink over public instance IPs.

NACLs are stateless subnet firewalls — useful as a coarse backstop, easy to misconfigure. Most teams should master security groups and private subnets before clever NACL tricks.

Security group hygiene

aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
  --query 'SecurityGroups[].{GroupId:GroupId,Ports:IpPermissions}' --output table

--------------------------------
|  DescribeSecurityGroups        |
+-------------+------------------+
|  sg-0abc    |  22, 3389, 443…  |
# review each 0.0.0.0/0 carefully

Do not put SSH/RDP on 0.0.0.0/0. Prefer SSM Session Manager (next lessons) with no inbound 22. Application SGs should accept traffic only from the load balancer SG, not the world. Restrict egress where exfiltration matters — default allow outbound is convenient and noisy for data-loss control.

Going deeper

Interface VPC endpoints keep traffic to S3/ECR/Logs off the public internet when paired with private subnets and endpoint policies. Endpoint policies are another authorization layer — least privilege them like bucket policies.

Security group change control belongs in IaC with policy-as-code checks for 0.0.0.0/0 on admin ports. Manual console edits are how "temporary" holes become permanent.

For Kubernetes on EC2/EKS, understand which SGs attach to nodes vs pods (CNI modes). Misapplied node SGs open every pod. Test with adversarial reaches from a probe namespace.

IPv6 open (::/0) is the twin of 0.0.0.0/0. Audit both. Dual-stack load balancers surprise teams that only grepped for IPv4 world-open rules.

Central egress (NAT + proxy) helps malware callback detection but concentrates availability risk. Monitor NAT capacity and proxy deny logs as security signals.

Flow Logs on critical VPCs feed detection when SG rules fail. Store them centrally with the same care as CloudTrail. Without Flow Logs, "who talked to the open port" becomes guesswork.

Use reachability analyzer and network access scopes for high-risk paths after changes. Guessing SG interactions in large accounts wastes IR minutes you will not have.

Document emergency SG reopen procedures with automatic expiry tags; temporary 0.0.0.0/0 without expiry is how temporary becomes forever.

Try this

Inventory security groups with 0.0.0.0/0 on sensitive ports in a lab account and close or justify each.

aws ec2 describe-security-groups --query 'length(SecurityGroups)'

42

Takeaway

Default deny inbound, least ports, private data stores, SG references over world-open CIDRs. Network and IAM are partners, not alternatives.

Next: KMS essentials so encryption at rest is intentional, not checkbox folklore.

Related