No Public Ingress Sgr

An ingress security group rule allows traffic from /0.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

When publishing web applications, use a load balancer instead of publishing directly to instances.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

1
2
3
4

resource "nifcloud_security_group_rule" "example" {
  group_name        = "allowtcp"
  availability_zone = "east-11"
}

1
2
3
4
5
6
7
8

resource "nifcloud_security_group_rule" "example" {
  type                 = "IN"
  security_group_names = [nifcloud_security_group.example.group_name]
  from_port            = 22
  to_port              = 22
  protocol             = "TCP"
  cidr_ip              = "10.0.0.0/16"
}

Links

• https://pfs.nifcloud.com/help/fw/rule_new.htm