SecurityGroup
Instance-level stateful filter.
class: Network
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:ec2:security-group |
region | ec2:DescribeSecurityGroups |
ec2:DescribeSecurityGroups |
As edge source
As edge target
Exposure sites
None.
Rules that touch SecurityGroup 8
An MSK cluster with publiclyAccessible enabled and an open broker security group (port 9198 from 0.0.0.0/0) is internet-reachable; IAM or SASL/SCRAM authentication still required.
A principal with ec2:AuthorizeSecurityGroupIngress or ec2:ModifySecurityGroupRules can add an allow-from-0.0.0.0/0 (or any source) inbound rule to a security group, potentially exposing protected resources to new network sources.
A compute resource is internet-exposed when its security group has an inbound rule allowing 0.0.0.0/0 (or ::/0) on a port, the resource has a public IP, and the subnet has a route to an Internet Gateway. All three conditions must be observed facts.
A security group with an inbound allow rule allowing 0.0.0.0/0 (any source) on a specific port grants network reachability to that port from the internet. This is derived from explicit SG record collection and represents the network-layer capability to reach a listening port on a protected compute node.
aws
CanReachPortA source co-located with the destination in the same Subnet reaches it when the destination's SG/NSG/firewall admits the source segment on a listening port.
A source reaches a destination across a SINGLE VPC/VNet peering when the destination's ingress admits it - peering is non-transitive, so exactly one direct hop.
A source whose subnet routes to the destination's subnet (intra-VPC/VNet routing) reaches the destination when its ingress rule admits the source.
A source reaches a destination through a shared transit hub (Transit Gateway/VWAN/NCC/Direct Connect gateway/VPN gateway) that forwards between attachments - transitive across the hub's associated route table.