Description

Detects misconfigured AWS security groups in Terraform that allow potentially unsafe TCP ingress access to HTTP/HTTPS ports. Such misconfigurations could expose web services to broader network access than intended, increasing the attack surface.

Detection Strategy

• Scans Terraform configuration files for 'aws_security_group' resource blocks

• Analyzes the ingress rules within security group configurations

• Reports a vulnerability when TCP ingress rules are detected with potentially unsafe port configurations for HTTP (80) or HTTPS (443)

• Examines the CIDR blocks and source specifications in the ingress rules to identify overly permissive access

Vulnerable code example

resource "aws_security_group" "vulnerable_sg" {
  name = "vulnerable-sg"
  description = "Security group with unsafe ingress"

  ingress {
    from_port   = 22  
    to_port     = 22
    protocol    = "tcp"...

✅ Secure code example

resource "aws_security_group" "secure_sg" {
  name        = "secure-sg"
  description = "Security group with restricted SSH access"

  ingress {
    from_port   = 22  
    to_port     = 22
    protocol    = "tcp"...