1. Log in to the AWS Management Console.
2. Navigate to the EC2 service.
3. In the left-hand menu, click on “Security Groups”.
4. Select the default security group.
5. In the “Inbound Rules” tab, remove any rules that allow unrestricted public traffic (i.e. 0.0.0.0/0).
6. Add specific rules for the required ports and protocols to allow traffic only from authorized sources.
7. Review and save the changes.

​

1. Open the AWS CLI on your local machine.
2. Run the following command to get the ID of the default security group in your AWS account:
   aws ec2 describe-security-groups --filters Name=group-name,Values=default --query 'SecurityGroups[*].GroupId' --output text
   
3. Run the following command to update the inbound rules of the default security group to allow only necessary traffic:
   aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol all --port all --cidr 0.0.0.0/0
   
   This command will remove all the inbound rules that allow unrestricted public traffic.
4. Now, add the necessary inbound rules to the default security group using the following command:
   aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol tcp --port <port-number> --cidr <ip-address>
   
   Replace <port-number> with the port number you want to allow traffic for and <ip-address> with the IP address range you want to allow traffic from.
5. Repeat step 4 for all the necessary inbound rules.
6. Verify the updated inbound rules of the default security group using the following command:
   aws ec2 describe-security-groups --group-ids <security-group-id>
   
   This command will display the updated inbound rules for the default security group.

1. Import the necessary AWS SDK libraries and modules in Python.

import boto3

2. Create a connection to the AWS EC2 service using the boto3 library.

ec2 = boto3.client('ec2')

3. Get the default security group ID using the describe_security_groups() method.

response = ec2.describe_security_groups(GroupNames=['default'])
sg_id = response['SecurityGroups'][0]['GroupId']

4. Revoke the ingress rules that allow unrestricted public traffic using the revoke_security_group_ingress() method.

response = ec2.revoke_security_group_ingress(
    GroupId=sg_id,
    IpPermissions=[
        {
            'IpProtocol': '-1',
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        }
    ]
)

5. Confirm that the ingress rules have been revoked by describing the security group again.

response = ec2.describe_security_groups(GroupNames=['default'])
print(response)

resource "aws_default_security_group" "default" {
  # Replace with the VPC where the default SG is misconfigured
  vpc_id = VPC_ID # e.g. aws_vpc.main.id

  # OPTIONAL: keep or define only least‑privilege rules you actually need.
  # The key part of the remediation is that there are NO rules with
  # CidrIp "0.0.0.0/0" or CidrIpv6 "::/0".

  # Example: allow traffic only within the VPC or from specific CIDRs, NOT the internet.
  ingress {
    description = "Allow intra-VPC traffic only"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = [INTERNAL_CIDR] # e.g. "10.0.0.0/16"
  }

  egress {
    description = "Allow all outbound traffic (adjust if you need stricter egress)"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = []
  }
}

• Substitute VPC_ID with the ID of the VPC that owns the default security group.
• Substitute INTERNAL_CIDR with your internal network range(s) that should be allowed, or remove/adjust the block per your requirements.
• This does not force replacement of the default security group; Terraform will update its rules in place, which can impact connectivity just like the CLI revoke-security-group-ingress commands.