Network Exposure

Which resources can be reached over which CIDRs and ports, via their security groups — worst exposure first. Gather AI, AWS.

Networks (VPCs)

Resources

Internet-exposed

Critical

High

Distinct CIDRs

demo data

vpc-ga-prod10.0.0.0/16vpc-0a1b2c3d · us-east-1Critical4 resources

CIDRs in use0.0.0.0/010.0.0.0/16

inference-gpu-01EC2Critical10.0.2.11sg-0aa1 — inference-gpu

Criticaltcp/22←0.0.0.0/0— SSH open to the internet

Scopedtcp/443←10.0.0.0/16

Scopedall/all←sg-0alb (alb-public)

api-prod-01EC2High10.0.1.20⦿ 54.81.22.9sg-0api — api-public

Hightcp/443←0.0.0.0/0— Open to the internet

Scopedtcp/8080←10.0.0.0/16

rds-bastionEC2Scoped10.0.3.5sg-0bas — bastion

Scopedtcp/5432←10.0.0.0/16

Scopedtcp/22←10.0.0.0/16

legacy-allow-allUnattached SGCriticalsg-0legacy

Criticalall/all←0.0.0.0/0— Open to the internet on all ports

vpc-ga-data10.20.0.0/16vpc-0d4e5f6a · us-west-2Critical2 resources

CIDRs in use0.0.0.0/010.0.0.0/810.20.0.0/16

etl-worker-01EC2Critical10.20.1.14sg-0etl — etl

Criticaltcp/6379←0.0.0.0/0— Redis open to the internet

Scopedtcp/22←10.20.0.0/16

warehouse-01EC2Medium10.20.2.30sg-0wh — warehouse

Scopedtcp/5432←10.20.0.0/16

Mediumtcp/5432←10.0.0.0/8— Broad internal range to a sensitive port