Security / Public reference

Substituted value is public

A same-file Fn::Sub or format result of 0.0.0.0/0 or ::/0.

What you need to supply

The parameter Default or literal, and the Fn::Sub or format that uses it, in the same file.

If it reports a finding

High severity. The suggested next step is to replace the substituted public range with an approved range.

What this does not prove

Fn::Sub of a parameter with no Default, Fn::Sub of AWS::Region, and format of 10.0.0.0/24 are not this finding. cidrsubnet, coalesce, and other functions stay unresolved. join and Fn::Join of known literals are a separate check. A value that appears only in a comment is not this finding.

Substitution that this check is written to notice

Parameters:
  Cidr:
    Type: String
    Default: 0.0.0.0/0
Resources:
  Sg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      SecurityGroupIngress:
        - CidrIp:
            Fn::Sub: "${Cidr}"

All review checks. Reading this page does not submit your infrastructure.