Description

Detects AWS EC2 launch templates that do not specify any security groups, which results in the use of the default VPC security group. Using the default security group is considered a security risk as it may have overly permissive default rules and doesn't follow the principle of least privilege.

Detection Strategy

• Checks EC2 launch template versions for security group configurations

• Reports a vulnerability if neither SecurityGroups nor SecurityGroupIds are specified in the launch template

• Only examines the latest version ($Latest) of each launch template

• Considers both standalone security group configurations and network interface configurations