Networking and DNS Required

Deny all traffic unless a rule allows it

Start every security group and firewall from deny. Allow only named ports from named sources, and open a port to the whole internet only on the load balancer.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Write each allowed path as its own rule in code. Point rules at other security groups instead of address ranges where you can. Only the public load balancer takes 0.0.0.0/0 and ::/0, and only on ports 80 and 443. Remove the default rules a new network comes with.

Example

# Lists rules open to the internet on ports other than 80 and 443. Expect nothing.
aws ec2 describe-security-group-rules --query \
  'SecurityGroupRules[?IsEgress==`false` && (CidrIpv4==`0.0.0.0/0` || CidrIpv6==`::/0`) && !(FromPort==`443` && ToPort==`443`) && !(FromPort==`80` && ToPort==`80`)].[GroupId,FromPort,ToPort]' \
  --output text

How to check

The query below finds no rule open to the internet on any port but 80 or 443. Rules open on 80 or 443 belong only to the load balancer's security group. A policy scan fails a pull request that adds one.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall.