Ingress rules that use single-address CIDRs (IPv4 /32 or IPv6 /128) are brittle. They often indicate hard-coded, single-IP access which can become stale, break when addresses are reassigned, and lead to unintended access or operational disruption.
This check inspects AWS::EC2::SecurityGroupIngress resources (Properties.CidrIp and Properties.CidrIpv6) and AWS::EC2::SecurityGroup resources’ Properties.SecurityGroupIngress[].CidrIp and CidrIpv6 entries. Any entry containing /32 (IPv4) or /128 (IPv6) will be flagged.
To remediate, avoid hard-coding single IPs by using SourceSecurityGroupId, AWS managed prefix lists, or appropriately scoped network CIDRs that reflect your trusted network. If a single-IP exception is required, document the justification and maintain a process to review and update it.
Secure configuration example (use security group reference instead of single IP):
MySecurityGroup:Type:AWS::EC2::SecurityGroupProperties:GroupDescription:Web server security groupVpcId:!Ref MyVPCSecurityGroupIngress:- IpProtocol:tcpFromPort:443ToPort:443SourceSecurityGroupId:!Ref BastionSecurityGroup
