Disable Public Access
Close 0.0.0.0/0 and allow only trusted IP ranges across services.
Public access means a resource is reachable by everyone, which leads to data exposure and interruption. We disable open access (0.0.0.0/0) to all tools and services and allow only required IP addresses.
Objective
Public access exposes services to the entire internet. Restricting access to known, trusted IP ranges dramatically reduces the risk of unauthorized access and data interruption.
Where access is restricted
We apply IP allow-listing consistently everywhere access controls exist:
| Layer | Control mechanism |
|---|---|
| AWS compute | Security Groups (EC2, ECS) |
| MongoDB Atlas | Cluster network access list |
| Amazon EKS | Cluster endpoint network access |
| Amazon RDS / Aurora | Security Groups |
| Internal tooling | Security Groups + allow-listed office/VPN IPs |
Best practices
- Never leave
0.0.0.0/0open on databases, clusters, or administrative ports. - Allow only required IP addresses — office ranges, VPN egress IPs, and specific service CIDRs.
- Combine with Private Networking so workloads have no public IP at all.
- Continuously verify with AWS Security Hub checks such as "security groups allowing unrestricted SSH (port 22)" and "publicly accessible S3 buckets."