Description

Detects AWS EC2 instances that are using default security groups, which is considered a security risk. Default security groups often have overly permissive rules and should be replaced with custom security groups that follow the principle of least privilege.

Detection Strategy

• Scans all EC2 instances in the specified AWS region

• Checks each instance's security group assignments

• Reports a vulnerability if any security group name contains the word 'default'

• Includes instance ID, region, and account information in the vulnerability report