c1.11 Close risky open administration ports
Do not expose SSH (22) or RDP (3389) to the internet. Prefer agent-based access with AWS Systems Manager Session Manager, which needs no open inbound ports at all.
Implementation guidance
Close 0.0.0.0/0 on admin ports
Security groups that allow unrestricted ingress (0.0.0.0/0) to ports 22 (SSH) or 3389 (RDP) are a top cause of intrusions: exposed hosts get brute-forced or exploited before they are patched. Close them, coordinating with any team that relies on those ports so they switch to a safer method first.
Prefer access with no open ports
The best fix is to stop opening admin ports altogether. AWS Systems Manager Session Manager gives shell/RDP access without any inbound ports, bastions, or SSH keys, with full audit logging. It needs the SSM Agent (preinstalled on most AWS AMIs) and an instance profile with the managed SSM policy. If you cannot use Session Manager, use EC2 Instance Connect, or at minimum restrict the source IPs to known admin ranges.
Find the gaps at scale
Use AWS Security Hub CSPM controls EC2.13 and EC2.14 to find security groups that expose 22/3389 across all accounts, and AWS Firewall Manager to enforce a baseline organization-wide.
How it fits together
How to validate
- Are any security groups allowing unrestricted ingress (0.0.0.0/0) to ports 22 or 3389? (Security Hub CSPM EC2.13 / EC2.14 will tell you.)
- How is administrative access to instances managed — Session Manager, Instance Connect, or open ports?
- Is a baseline enforced org-wide (e.g. with Firewall Manager) so new accounts do not reintroduce the risk?
Threats addressed
- Unrestricted ingress to admin ports (22/3389) lets adversaries attempt brute-force SSH/RDP logins or exploit an unpatched service to take control of the host.
AWS services
AWS Systems Manager 
AWS Security Hub 
AWS Firewall Manager Pricing
Security groups and AWS Systems Manager Session Manager have no additional cost. Security Hub CSPM and Firewall Manager are billed separately (see their pricing pages).