c2.11 Limit network access with least-privilege security groups
Grant only the minimum access in security groups. Developers often open a group for testing and forget to close it. Reference security groups by group instead of by CIDR to build tiered access, and audit for over-permissive rules with AWS Firewall Manager.
Implementation guidance
Least privilege in every security group
Grant only the ports and sources a resource actually needs. Open groups created "just for testing" are routinely promoted to production. Prioritize closing risky administration ports (see Secure EC2 management), then review every group — especially non-web ports and internal web apps that accept traffic from anywhere. The AWS Config restricted-common-ports rule flags open ports you specify.
Reference security groups instead of CIDRs
Build tiered access by referencing one security group from another:
- An Application Load Balancer with sg-alb accepts 80/443 from the internet.
- Web servers with sg-web accept 80/443 only from sg-alb (only the load balancer).
- The database with sg-db accepts 3306 only from sg-web (only the web tier).
Traffic to the web tier is then always inspected by the ALB (where you attach AWS WAF), and instances added by autoscaling inherit the right access automatically.
Audit at scale with Firewall Manager
AWS Firewall Manager audits security groups and enforces rules centrally across accounts, flagging over-permissive and unused groups. Its value grows with organization size and with how resources are created (manual vs. infrastructure as code).
Reference a source group with the CLI
Allow the database (sg-db) to accept 3306 only from the web tier's group (sg-web) — no CIDR, so autoscaled instances inherit access automatically:
aws ec2 authorize-security-group-ingress \
--group-id sg-db \
--protocol tcp --port 3306 \
--source-group sg-webHow to validate
- Who defines security groups, and are they trained to allow only the minimum access?
- Are critical applications restricted to only the ports they need?
- Are internal applications accepting traffic from anywhere?
- Are you using AWS Firewall Manager (or similar) to find and audit over-permissive groups?
Threats addressed
- Misconfigured security groups let adversaries reach and probe services that should never have been exposed.
- Developers frequently allow broad access "to restrict later" and then never do.
AWS services
Amazon VPC 
AWS Firewall Manager 
AWS Config Pricing
Security groups have no additional cost. If you use AWS Firewall Manager, see its pricing.