LOW
Source
Trivy
Frameworks

CIS AWS 1.4

ID
AVD-AWS-0173

Default security group should restrict all traffic

Configuring all VPC default security groups to restrict all traffic will encourage least privilege security group development and mindful placement of AWS resources into security groups which will in-turn reduce the exposure of those resources.

Impact

Easier to accidentally expose resources - goes against principle of least privilege