To find exposed ports on an AWS-hosted web app, trace traffic from its public entry point through the load balancer and backend tiers, then inspect every security group attached to each resource. Compare each rule’s direction, protocol, port range, and peer against the application’s intended traffic. AWS Config can flag selected public ingress rules, while Reachability Analyzer and Network Access Analyzer help evaluate configured network paths; none of these checks proves that an outside probe reached a listening service.
What an AWS security-group review can—and cannot—tell you
A security group is an allow-list for network traffic associated with AWS resources. Its rules specify the traffic permitted in or out; AWS documents allow rules rather than deny rules. Rules from all security groups attached to a resource are aggregated, so one restrictive-looking group does not cancel a broad rule in another. A new security group starts with no inbound rules and initially allows all outbound traffic. AWS’s security group rules guide explains the rule behavior and fields.
As an Amazon Associate I earn from qualifying purchases.
A useful exposure review asks whether a path is allowed by AWS configuration and whether that path is intended. It is not the same as scanning from the public internet and confirming that a service actually responds. A rule allowing traffic does not establish that a process is listening, that routing and other controls permit the connection, or that an external probe succeeded.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOnly review accounts and systems you are authorized to assess. If you also plan an outside-in probe, coordinate it with the application or asset owner; the AWS configuration tools described here do not supply an external scanning procedure.
#1 Best Overall
Trace the intended path before judging a port
Start with the application’s hostname and identify its public entry point, commonly an Application Load Balancer. Follow the load balancer to its target group and targets, then map any downstream application and data services. Include instances, network interfaces, and other relevant resources, not just the load balancer.
A typical tiered design permits public HTTP or HTTPS at the load balancer. The web tier accepts application traffic from the load balancer’s security group, and a database tier accepts database traffic from the web tier’s group. This narrows each tier to its intended upstream peer rather than making every backend publicly reachable. AWS illustrates this arrangement in its security group rules guide.
For the public-facing load balancer, compare inbound rules with its configured listeners. A publicly reachable HTTP or HTTPS listener can be intentional; an open port with no corresponding listener, or a backend that accepts direct public traffic when it should only accept traffic from the load balancer, deserves investigation. AWS Support recommends matching an Application Load Balancer’s security group to its listener ports and limiting target security groups to traffic and control connections from the associated load balancer groups. See AWS Support’s security checks.
Inventory every security group and rule
- List the resources in the path. Record the load balancer, its targets, web and application tiers, and data tier, where present. Note the account and Region so the review stays scoped.
- Enumerate all groups attached to each resource. Because attached groups’ rules are combined, inspect every associated group for the load balancer, instance, network interface, or other resource—not only the group with the most descriptive name.
- Record each rule’s fields. For ingress, capture protocol, port or range, and source. For egress, capture protocol, port or range, and destination. Include the rule description if present. A port number alone is not enough to characterize exposure.
- Check both address families. Treat IPv4
0.0.0.0/0and IPv6::/0as unrestricted public peers for their respective address families. Also note narrower CIDRs, including selected public IP ranges: they are not open to every address, but may still expose a service beyond its intended audience. - Compare rules to the mapped path. Verify that public ingress belongs at the intended edge, that backend ingress names the expected upstream security group, and that egress destinations support the application’s required traffic.
AWS documents the protocol, port-range, and source-or-destination fields in its security group rules guide. For default groups, AWS recommends purpose-specific security groups rather than relying on the VPC default group; see Default security groups for your VPCs.
Rank #3
Decide whether an allowed port is actually a problem
Judge each rule in context, not by port number alone. For every broad or unexpected rule, ask whether the resource is meant to receive that traffic, whether the port and protocol match the configured service, and whether the peer should instead be a specific upstream security group or CIDR. For example, public web traffic may belong on the load balancer, while a database port on a publicly reachable web instance may not belong there.
- At the load balancer: Does each public ingress port correspond to a configured listener and an intended public service?
- At a target or web server: Does application ingress come from the associated load balancer security group rather than from all IPv4 or IPv6 addresses?
- At a database: Is database ingress limited to the web or application tier that needs it?
- For management access: Is SSH or RDP restricted to authorized sources rather than unrestricted internet ingress?
- For egress: Is broad outbound access required? A change that narrows destinations can disrupt application dependencies, so evaluate required outbound traffic before editing.
Use AWS Config for rule-based public-ingress checks
AWS Config offers two managed rules that answer different questions. The restricted-port rule checks a specified set of ports for unrestricted ingress; the authorized-ports rule checks unrestricted ingress against an explicit TCP/UDP port allowlist. Their findings reflect the rule’s configured scope and parameters, not every possible way a service might be reachable.
| Check | What it evaluates | Trigger and key qualification |
|---|---|---|
VPC_SG_PORT_RESTRICTION_CHECK |
Unrestricted ingress on configured ports and protocols. Its defaults are TCP and UDP ports 22 and 3389, from unrestricted IPv4 or IPv6. | Periodic evaluation. Ports and protocol selection are configurable; a clean default result does not mean all sensitive or custom ports were checked. AWS Config rule details. |
VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS |
Unrestricted IPv4 or IPv6 ingress compared with an explicit authorized TCP/UDP port list. | Evaluates on configuration changes and periodically. The usefulness of the result depends on the allowlist matching the organization’s actual intended public ports. AWS Config rule details. |
Before relying on either result, confirm the rule’s parameters and that AWS Config is recording the resources and Region you intend to review. These managed checks are useful for finding particular classes of rules; they are not a universal inventory of every public path or proof that a service answered a connection attempt.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Analyze configured network paths
Use AWS Reachability Analyzer to test a selected path between VPC resources, specifying the source and destination relevant to the question—for example, a load balancer and target. Use Network Access Analyzer to identify unintended network access patterns across the AWS network configuration. AWS describes both in its infrastructure security control recommendations.
Best Value
These tools complement rule inventory: they help assess whether AWS’s configured network path permits reachability or whether access patterns are unintended. They analyze modeled AWS configuration, not a live internet probe. Record the exact endpoints and path you analyzed so a result is not mistaken for a test of some other source, destination, or external network.
Check blind spots and remediate without breaking the app
Do not treat a clean standard-port check as proof that no public opening exists. AWS calls out non-standard TCP 8443 as an example that common checks may miss, as well as rules limited to selected public IP addresses. Review actual listeners and rules for the application’s custom ports and public CIDRs. AWS discusses these blind spots and a custom Config/Lambda auditing pattern in its public-IP security group audit guidance.
When a rule is unnecessary, remove it; when access is required, narrow it to the intended CIDR or upstream security group and the required protocol and port range. Test changes in a non-production environment and verify application behavior before applying them broadly. In particular, assess outbound dependencies before changing egress rules: AWS warns that outbound-rule changes can disrupt required application traffic. A configuration finding is a prompt to validate intended design, not an instruction to close a port without checking its role.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
