r1.1 Close risky open ports in security groups
Identify and remove security group rules that expose administrative or sensitive ports (e.g. SSH 22, RDP 3389, databases) to 0.0.0.0/0. This is the highest-impact, lowest-effort control to reduce the CDE attack surface.
AWS services
Amazon VPC Security Groups 
AWS Config 
AWS Security Hub 
AWS Systems Manager Requirement 1
Install and Maintain Network Security Controls
PCI sub-requirements covered
- 1.2 NSCs are configured and maintained
- 1.3 Network access to and from the CDE is restricted
- 1.4 Network connections between trusted and untrusted networks are controlled
How to implement on AWS
Use AWS Config with the managed rules restricted-ssh and restricted-common-ports to detect exposures. Review Security Hub findings (controls EC2.13/EC2.14). Replace 0.0.0.0/0 rules with specific CIDR ranges or references to other security groups. For administrative access, prefer AWS Systems Manager Session Manager instead of opening inbound ports.
Practical implementation
How this control is implemented in each reference architecture:
In the single VPC, audit each tier's security group. Remove any 0.0.0.0/0 rule on SSH (22), RDP (3389), or database ports. Allow inter-tier traffic only by referencing the source security group (e.g. the app SG allows 5432 only from the app-tier SG). Use Session Manager for admin access so no inbound admin ports are needed at all.
Single-account, 3-tier →Enforce the control at scale: deploy the AWS Config managed rules (restricted-ssh, restricted-common-ports) organization-wide via a conformance pack, and aggregate findings in the security tooling account's Security Hub. Add an SCP on the PCI OU that prevents authorizing 0.0.0.0/0 ingress on administrative ports, and standardize Session Manager access through the shared services account.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine NSC configuration standards and settings to verify that only approved services, protocols, and ports are in use, each with business justification (1.2.5.a, 1.2.5.b).
- Examine NSC configurations to verify that inbound traffic to the CDE is restricted to only what is necessary and all other traffic is denied (1.3.1.b).
- Examine NSC configurations to verify that connections between trusted and untrusted networks are restricted (1.4.1.b).
Evidence in AWS
- AWS Config compliance report for the restricted-ssh and restricted-common-ports rules (all resources COMPLIANT).
- Resolved Security Hub findings EC2.13 and EC2.14.
- Export of security group rules showing no 0.0.0.0/0 on administrative ports.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 1.2 — The way that NSCs are configured and operate is defined and consistently applied.
- 1.3 — Unauthorized traffic cannot enter the CDE.
- 1.4 — Unauthorized traffic cannot traverse network boundaries between trusted and untrusted networks.
Learning resources
References
- AWS Security Hub: EC2.13, EC2.14
- AWS Security Maturity Model: Cleanup risky open ports