Skip to content
ENExplore Calculators

Cloud Security Group Calculator

Check security group rule usage against AWS quotas and score the risk from 0.0.0.0/0 sources, exposed admin ports and unattached groups.

About Cloud Security Group Calculator

AWS enforces two separate quotas that teams hit in different ways: 60 rules per direction per group, and a product limit where groups per interface × rules per group cannot exceed 1000. This calculator reports both, then scores the rules themselves — an admin port open to the internet is ten points because it is the single most exploited cloud misconfiguration there is. Security group quotas fail at deploy time in the middle of an incident response, and a 0.0.0.0/0 rule on port 22 is found by internet-wide scanners within minutes of being created.

Formulas

Cloud Security Group

Interface rule count = security groups per interface × (inbound + outbound rules), which AWS caps at 1000; quota used = rules ÷ 60 × 100 for each direction.

rulesPerGroup
Inbound plus outbound rules in one security group
eniRulesUsed
Rules the data plane evaluates for one network interface
maxGroupsByRules
Groups that fit within both the per-interface count and the 1000-rule product

Risk scoring

Risk = 10 points per public admin-port rule + 5 per 0.0.0.0/0 rule + 1.5 per wide-CIDR rule + 0.2 × unattached-group percentage, clamped to 0–100.

adminPortRules
Rules exposing TCP 22 or 3389 to the internet
openToAnyRules
Inbound rules whose source is 0.0.0.0/0
unusedRatio
Unattached groups ÷ all groups × 100

Worked example

With the default values below, Cloud Security Group Calculator returns Security Group Risk Score of 80.3. Change any input above and every figure here is recalculated in your browser.

Inputs used

Inbound rules in the largest security groupaccepts 0–1,000 rules
48 rules
Outbound rules in the largest security groupaccepts 0–1,000 rules
28 rules
Rules per security group limitaccepts 1–1,000 rules
60 rules
Security groups attached per network interfaceaccepts 1–16 groups
4 groups
Security groups per interface limitaccepts 1–16 groups
5 groups
Rules per network interface limitaccepts 1–1,000 rules
1,000 rules
Inbound rules sourced from 0.0.0.0/0accepts 0–1,000 rules
6 rules
Inbound rules sourced from a /8 to /16 rangeaccepts 0–1,000 rules
11 rules
Rules exposing SSH 22 or RDP 3389 publiclyaccepts 0–1,000 rules
3 rules
Security groups in the VPCaccepts 1–20,000 groups
180 groups
Security groups attached to nothingaccepts 0–20,000 groups
34 groups

Results

Security Group Risk Score
80.3 / 100
Inbound Rule Quota Used
80.0%
Outbound Rule Quota Used
46.7%
Rules Evaluated per Interface
304 rules
Interface Rule Quota Used
30.4%
Inbound Rules Remaining
12 rules
Groups That Fit the Interface Limit
5 groups
Inbound Rules With a Wide Source
35.4%
Verdict
Critical — move SSH and RDP behind Session Manager or a bastion and delete the public rules

Step by step

  1. 1Values used
  2. 2Cloud Security Group
  3. 3Risk scoring
  4. 4Security Group Risk Score= 80.3 / 100
  5. 5Inbound Rule Quota Used= 80.0
  6. 6Outbound Rule Quota Used= 46.7
  7. 7Rules Evaluated per Interface= 304 rules
  8. 8Interface Rule Quota Used= 30.4
  9. 9Inbound Rules Remaining= 12 rules

Assumptions and limits

  • The result is derived only from the 11 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cloud Security Group calculated?

Interface rule count = security groups per interface × (inbound + outbound rules), which AWS caps at 1000; quota used = rules ÷ 60 × 100 for each direction. AWS enforces two separate quotas that teams hit in different ways: 60 rules per direction per group, and a product limit where groups per interface × rules per group cannot exceed 1000. This calculator reports both, then scores the rules themselves — an admin port open to the internet is ten points because it is the single most exploited cloud misconfiguration there is.

Why does Cloud Security Group matter?

Security group quotas fail at deploy time in the middle of an incident response, and a 0.0.0.0/0 rule on port 22 is found by internet-wide scanners within minutes of being created.

What values do I need to enter?

This calculator takes 11 inputs: Inbound rules in the largest security group, Outbound rules in the largest security group, Rules per security group limit, Security groups attached per network interface, Security groups per interface limit, Rules per network interface limit, Inbound rules sourced from 0.0.0.0/0, Inbound rules sourced from a /8 to /16 range, Rules exposing SSH 22 or RDP 3389 publicly, Security groups in the VPC, Security groups attached to nothing. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Can I raise the 60-rule limit?

Yes, rules per security group is an adjustable quota, but raising it consumes the 1000-rule per-interface budget faster: if you go to 100 rules per direction, five groups per interface already puts you at the 1000 limit. Prefer prefix lists — one rule referencing a managed prefix list replaces dozens of CIDR rules and counts as one.

Are unattached security groups actually a risk?

Not directly, because nothing evaluates them. They are a review risk: when 34 of 180 groups are dead, every audit, diff and change review carries a third more noise, and the group that quietly got a 0.0.0.0/0 rule hides in it.

Related Calculators

Cloud Security Group Calculator | Calcrivo