---
title: Security groups should restrict traffic to trusted IPv4 addresses
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Security groups should restrict traffic
  to trusted IPv4 addresses
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Security groups should restrict traffic to trusted IPv4 addresses
 
## Description{% #description %}

AWS security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports, such as SSH (22) and RDP (3389). A rule fails when it uses TCP (6), UDP (17), or ALL (-1) protocols, has a port range that includes 22 or 3389 (including ALL ports), and has a source of 0.0.0.0/0. Security groups are stateful and do not support DENY rules, so any such rule is non-compliant. Other environment-specific administration ports are not evaluated.

## Remediation{% #remediation %}

Before removing access, make sure administrators can still connect through another mechanism.

1. In the [Amazon VPC console](https://console.aws.amazon.com/vpc/home), select **Security Groups**, choose each affected group, and click **Edit inbound rules** on the **Inbound rules** tab.
1. Change the source of each offending rule to a range other than 0.0.0.0/0 or delete the rule, then click **Save rules**. See [Security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html).

## References{% #references %}

- [Control traffic to your AWS resources using security groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html)
- [Security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)