Not restricting egress allows connections to the public internet on any port and host, significantly increasing the extent of a compromise.

Remediation

• Restrict CIDR to known range
• Restrict port to white listed set of ports.
• See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group

Metadata

• Severity: high
• Slug: vpc-unrestricted-egress

CWEs

• 284: Improper Access Control

OWASP

• A05:2021: Security Misconfiguration