Cloud Security Group Calculator

Interface rule count = security groups per interface × (inbound + outbound rules), which AWS caps at 1000; quota used = rules ÷ 60 × 100 for each direction. AWS enforces two separate quotas that teams hit in different ways: 60 rules per direction per group, and a product limit where groups per interface × rules per group cannot exceed 1000. This calculator reports both, then scores the rules themselves — an admin port open to the internet is ten points because it is the single most exploited cloud misconfiguration there is.

Security group quotas fail at deploy time in the middle of an incident response, and a 0.0.0.0/0 rule on port 22 is found by internet-wide scanners within minutes of being created.

This calculator takes 11 inputs: Inbound rules in the largest security group, Outbound rules in the largest security group, Rules per security group limit, Security groups attached per network interface, Security groups per interface limit, Rules per network interface limit, Inbound rules sourced from 0.0.0.0/0, Inbound rules sourced from a /8 to /16 range, Rules exposing SSH 22 or RDP 3389 publicly, Security groups in the VPC, Security groups attached to nothing. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Yes, rules per security group is an adjustable quota, but raising it consumes the 1000-rule per-interface budget faster: if you go to 100 rules per direction, five groups per interface already puts you at the 1000 limit. Prefer prefix lists — one rule referencing a managed prefix list replaces dozens of CIDR rules and counts as one.

Not directly, because nothing evaluates them. They are a review risk: when 34 of 180 groups are dead, every audit, diff and change review carries a third more noise, and the group that quietly got a 0.0.0.0/0 rule hides in it.