# Review firewall or cloud security group rules for risky openings

Audits a rule set for overly broad access, exposed admin ports, and stale rules, and proposes a tighter version.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/review-firewall-or-cloud-security-group-rules-for-risky-openings

## Prompt

```text
Review my firewall or cloud security group rules and flag risky ones.

**Rules:** [PASTE the rule set - source, destination, port or protocol, action, description; mask public IPs if needed]
**Platform:** [e.g. "AWS security groups", "Azure NSG", "Palo Alto", "FortiGate", "iptables"]
**What these systems are:** [e.g. "public web servers", "internal database", "office network"]
**Legitimate access needed:** [who or what must reach which services]
**Logging and hit count data:** [PASTE if available - shows unused rules]

Check for:
1. Any-any or overly broad rules (0.0.0.0/0, ::/0, large CIDR ranges).
2. Admin and risky services open to the internet: RDP 3389, SSH 22, SMB 445, database ports, management interfaces.
3. Rules with no description or owner, or that look temporary.
4. Unused rules (zero hits) and shadowed or redundant rules, considering rule order.
5. Missing default-deny, or outbound rules that allow everything.
6. Better alternatives: VPN or zero-trust access, bastion hosts, private endpoints, allowlisting specific IPs.

Return:
- A findings table: Rule | Issue | Risk (high/medium/low) | Recommended change.
- A proposed tightened rule set.
- A safe change plan: test steps, order of changes, and how to roll back if something breaks.

Do not tell me to remove a rule without noting what might depend on it; mark those [CONFIRM WITH OWNER].
```

## What to fill in

- who or what must reach which services
- PASTE if available - shows unused rules
- CONFIRM WITH OWNER

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.