Preventing Open Security Groups: VS Code Copilot and 0.0.0.0/0

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

VS Code Copilot is setting up a development server. To avoid firewall complexity, it creates a security group rule allowing all inbound traffic:

aws ec2 authorize-security-group-ingress \
  --group-id sg-123 \
  --protocol all \
  --cidr 0.0.0.0/0

SSG blocks the API call before it reaches AWS — 0.0.0.0/0 ingress on all ports is a critical security misconfiguration.

# illustrative sample output
[BLOCK] bash › aws ec2 authorize-security-group-ingress ... --cidr 0.0.0.0/0 — rule: no-sg-open-ingress

Give SSG context

SSG evaluates VS Code Copilot's AWS CLI commands via the SSG MCP Server integration.

Required context

rule no-sg-open-ingress {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "authorize-security-group-ingress"
  AND command CONTAINS "0.0.0.0/0"
  MESSAGE "0.0.0.0/0 ingress rule opens all ports to the internet. Use a specific CIDR or security group reference."
}

Optional context

Also block IPv6 open ingress:

rule no-sg-open-ingress-ipv6 {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "authorize-security-group-ingress"
  AND command CONTAINS "::/0"
  MESSAGE "IPv6 0.0.0.0/0 equivalent (::/0) ingress is blocked. Use a specific CIDR range."
}

What SSG does

SSG intercepts the AWS CLI command before it makes a network request. The security group rule is never created — no public exposure window is opened.

Ask the agent to use specific CIDRs

0.0.0.0/0 ingress was blocked. Use the minimum required access:
  --cidr 203.0.113.5/32          # specific IP
  --cidr 10.0.0.0/8              # internal VPC CIDR
  --source-group sg-456          # allow from specific security group
For SSH/admin access, use AWS Systems Manager Session Manager instead of opening port 22.

Block Terraform/CloudFormation too

The same misconfiguration can appear in IaC files:

rule no-terraform-open-ingress {
  enabled true
  priority 100
  severity error
  DENY write
  IF path ENDS_WITH ".tf"
  AND content CONTAINS "cidr_blocks"
  AND content CONTAINS "0.0.0.0/0"
  MESSAGE "Terraform security group with 0.0.0.0/0 is blocked. Use specific CIDR ranges."
}

Audit AWS network changes

Use ssg dashboard to review all security group modifications. Regularly run aws ec2 describe-security-groups to audit existing rules for open ingress, not just new ones.