Security / Public reference

Referenced value is public

A var, local, or CloudFormation parameter Default of 0.0.0.0/0 or ::/0 used through a reference. Files in one audit share those defaults.

What you need to supply

The variable, local, or parameter Default and the resource or module argument that references it. They can be in different files of the same audit.

If it reports a finding

High severity. The suggested next step is to replace the referenced public range with an approved range.

What this does not prove

A private default such as 10.0.0.0/24 or 10.0.0.0/16 is not this finding. A parameter with no Default stays unresolved. A simple Fn::Sub or format of a known literal is a separate check. A value that appears only in a comment is not this finding.

Reference that this check is written to notice

variable "cidr" {
  default = "0.0.0.0/0"
}
resource "aws_security_group" "web" {
  ingress {
    cidr_blocks = [var.cidr]
  }
}

All review checks. Reading this page does not submit your infrastructure.