# AWS Config compliance results proving the network boundary is controlled — no security group exposes SSH to the internet, groups open to 0.0.0.0/0 only allow authorized ports, and every VPC's default security group denies all traffic

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-network-boundary-protection

Recipe id: `config-network-boundary-protection` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-CNA-ULN`
- KSI `KSI-SVC-EIS`
- control `sc-7`

## Collection

Kind: `config-rule`

```sh
# restricted-ssh
aws configservice get-compliance-details-by-config-rule --config-rule-name restricted-ssh --compliance-types NON_COMPLIANT
# vpc-sg-open-only-to-authorized-ports
aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-sg-open-only-to-authorized-ports --compliance-types NON_COMPLIANT
# vpc-default-security-group-closed
aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-default-security-group-closed --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# restricted-ssh-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names restricted-ssh
# vpc-sg-open-only-to-authorized-ports-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-sg-open-only-to-authorized-ports
# vpc-default-security-group-closed-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-default-security-group-closed
# describe-regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output text
# list-accounts
aws organizations list-accounts --query 'Accounts[].Id' --output text
```

## Expected output

Three EvaluationResults arrays; empty NON_COMPLIANT sets mean no security group leaves SSH (port 22) open to 0.0.0.0/0 or ::/0, any internet-open group is limited to the authorizedTcpPorts/authorizedUdpPorts you set, and every default security group is closed. Managed rule identifiers: INCOMING_SSH_DISABLED (rule name restricted-ssh), VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS, VPC_DEFAULT_SECURITY_GROUP_CLOSED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"restricted-ssh.EvaluationResults","op":"count_eq","value":0,"controls":["sc-7"],"description":"No security group exposes port 22 to 0.0.0.0/0 or ::/0."}
- {"field":"vpc-sg-open-only-to-authorized-ports.EvaluationResults","op":"count_eq","value":0,"controls":["sc-7"],"description":"Any internet-open security group is limited to the ports you declared authorized."}
- {"field":"vpc-default-security-group-closed.EvaluationResults","op":"count_eq","value":0,"controls":["sc-7"],"description":"Every VPC default security group denies all inbound and outbound traffic."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["sc-7"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"restricted-ssh-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-7"],"description":"restricted-ssh has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"restricted-ssh-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-7"],"description":"restricted-ssh has a successful evaluation on record."}
- {"field":"vpc-sg-open-only-to-authorized-ports-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-7"],"description":"vpc-sg-open-only-to-authorized-ports has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"vpc-sg-open-only-to-authorized-ports-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-7"],"description":"vpc-sg-open-only-to-authorized-ports has a successful evaluation on record."}
- {"field":"vpc-default-security-group-closed-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-7"],"description":"vpc-default-security-group-closed has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"vpc-default-security-group-closed-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-7"],"description":"vpc-default-security-group-closed has a successful evaluation on record."}

## GovCloud

AWS Config and all three managed rules are available in AWS GovCloud (US); VPC and security-group ARNs use partition arn:aws-us-gov

## Notes

Set VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS parameters (authorizedTcpPorts/authorizedUdpPorts) to your documented ingress allow-list, otherwise any 0.0.0.0/0 rule is NON_COMPLIANT. These three cover security-group ingress; for full SC-07 boundary evidence also collect NACL and subnet routing posture and, where used, restricted-common-ports and vpc-flow-logs-enabled. Note VPC_DEFAULT_SECURITY_GROUP_CLOSED may lag on deleted VPCs until the next baselining pass. These three rules read security-group ingress and nothing else; SC-07(b) — the logical separation FedRAMP's own guidance singles out — plus NACLs, route tables, gateways and VPC endpoints are a human's architecture assertion against this output. MAS-CSO-FLO is not claimed: its artifact is the enumeration of permitted connections, and a NON_COMPLIANT filter is empty on a compliant estate.

## References

- {"title":"AWS Config managed rule: restricted-ssh (INCOMING_SSH_DISABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html"}
- {"title":"AWS Config managed rule: vpc-sg-open-only-to-authorized-ports","url":"https://docs.aws.amazon.com/config/latest/developerguide/vpc-sg-open-only-to-authorized-ports.html"}
- {"title":"AWS Config managed rule: vpc-default-security-group-closed","url":"https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html"}