---
title: Default VPC security group should restrict all traffic
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Default VPC security group should
  restrict all traffic
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Default VPC security group should restrict all traffic
 
## Description{% #description %}

AWS VPC default security groups should contain no inbound rules and no outbound rules. Each VPC, including the default VPC in every region, comes with a default security group; restricting all of its traffic encourages least-privilege security groups and prevents resources from being placed in an overly permissive group by accident. This rule fails a security group named exactly `default` (case-insensitive) that has any inbound or outbound rule, and fails a group whose name is missing, null, or empty because the default group cannot be ruled out. Check separately that no resources are still attached to the default security group.

## Remediation{% #remediation %}

Move resources out of the default security group into least-privilege security groups, then remove all inbound and outbound rules from each default security group using the [VPC console](https://console.aws.amazon.com/vpc/home) or the `aws ec2 revoke-security-group-ingress` and `aws ec2 revoke-security-group-egress` commands with the rule IDs returned by `aws ec2 describe-security-group-rules`. See [Default security groups for your VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/default-security-group.html) and [Delete security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-security-group-rules.html).

## References{% #references %}

- [Default security groups for your VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/default-security-group.html)
- [Delete security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-security-group-rules.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)