Review firewall or cloud security group rules for risky openings
Audits a rule set for overly broad access, exposed admin ports, and stale rules, and proposes a tighter version.
The prompt
Review my firewall or cloud security group rules and flag risky ones.
Rules: [PASTE the rule set - source, destination, port or protocol, action, description; mask public IPs if needed]
Platform: [e.g. "AWS security groups", "Azure NSG", "Palo Alto", "FortiGate", "iptables"]
What these systems are: [e.g. "public web servers", "internal database", "office network"]
Legitimate access needed: [who or what must reach which services]
Logging and hit count data: [PASTE if available - shows unused rules]
Check for:
1. Any-any or overly broad rules (0.0.0.0/0, ::/0, large CIDR ranges).
2. Admin and risky services open to the internet: RDP 3389, SSH 22, SMB 445, database ports, management interfaces.
3. Rules with no description or owner, or that look temporary.
4. Unused rules (zero hits) and shadowed or redundant rules, considering rule order.
5. Missing default-deny, or outbound rules that allow everything.
6. Better alternatives: VPN or zero-trust access, bastion hosts, private endpoints, allowlisting specific IPs.
Return:
- A findings table: Rule | Issue | Risk (high/medium/low) | Recommended change.
- A proposed tightened rule set.
- A safe change plan: test steps, order of changes, and how to roll back if something breaks.
Do not tell me to remove a rule without noting what might depend on it; mark those [CONFIRM WITH OWNER].
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- who or what must reach which services
- PASTE if available - shows unused rules
- CONFIRM WITH OWNER
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Analyze logs to find what went wrongReads logs to identify errors, patterns, and the likely root cause.
- Get a beginner-friendly code review of my first projectA ranked set of the five improvements that matter most, explained simply, plus what you did well and what to learn next.
- Turn a threat report into Sigma detection rulesExtracts behaviors from a threat report, maps them to MITRE ATT&CK, and writes tuned Sigma rules with test notes.
- Review every change since my last release before shippingA pre-release review of all changes since a tag: missing translations, simplifications, breaking changes, security, and a draft changelog.