Practice Now
AWS
CloudFormation
Security Groups
Networking
Cloud Security

How to specify all ports in Security group - CloudFormation

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
AWS & CloudNetworking & APIsSecurity & Auth

Introduction

In AWS CloudFormation, you specify "all ports" in a security group by setting IpProtocol to "-1", which means all protocols and implicitly all ports. For TCP or UDP specifically, set FromPort: 0 and ToPort: 65535 to cover the full port range. The "-1" protocol is the simplest approach and is equivalent to selecting "All traffic" in the AWS Console.

All Traffic (All Protocols, All Ports)

yaml
1Resources:
2  MySecurityGroup:
3    Type: AWS::EC2::SecurityGroup
4    Properties:
5      GroupDescription: Allow all traffic
6      VpcId: !Ref MyVPC
7      SecurityGroupIngress:
8        - IpProtocol: "-1"
9          CidrIp: 10.0.0.0/8
10      SecurityGroupEgress:
11        - IpProtocol: "-1"
12          CidrIp: 0.0.0.0/0

When IpProtocol is "-1", you must NOT specify FromPort or ToPort. AWS treats this as all protocols (TCP, UDP, ICMP, and others) on all ports.

All TCP Ports

yaml
1SecurityGroupIngress:
2  - IpProtocol: tcp
3    FromPort: 0
4    ToPort: 65535
5    CidrIp: 10.0.0.0/8

This allows all TCP traffic (ports 0-65535) from the specified CIDR range.

All UDP Ports

yaml
1SecurityGroupIngress:
2  - IpProtocol: udp
3    FromPort: 0
4    ToPort: 65535
5    CidrIp: 10.0.0.0/8

ICMP (All Types)

yaml
1SecurityGroupIngress:
2  - IpProtocol: icmp
3    FromPort: -1
4    ToPort: -1
5    CidrIp: 10.0.0.0/8

For ICMP, FromPort represents the ICMP type and ToPort the ICMP code. Setting both to -1 means all ICMP types and codes.

Complete Security Group Example

yaml
1Resources:
2  WebServerSecurityGroup:
3    Type: AWS::EC2::SecurityGroup
4    Properties:
5      GroupDescription: Web server security group
6      VpcId: !Ref VPC
7      SecurityGroupIngress:
8        # HTTP from anywhere
9        - IpProtocol: tcp
10          FromPort: 80
11          ToPort: 80
12          CidrIp: 0.0.0.0/0
13        # HTTPS from anywhere
14        - IpProtocol: tcp
15          FromPort: 443
16          ToPort: 443
17          CidrIp: 0.0.0.0/0
18        # SSH from admin network only
19        - IpProtocol: tcp
20          FromPort: 22
21          ToPort: 22
22          CidrIp: 10.0.1.0/24
23        # All traffic from other instances in same security group
24        - IpProtocol: "-1"
25          SourceSecurityGroupId: !Ref WebServerSecurityGroup
26      SecurityGroupEgress:
27        # Allow all outbound traffic
28        - IpProtocol: "-1"
29          CidrIp: 0.0.0.0/0
30      Tags:
31        - Key: Name
32          Value: WebServerSG

Using Security Group References

yaml
1# Allow all traffic from another security group
2SecurityGroupIngress:
3  - IpProtocol: "-1"
4    SourceSecurityGroupId: !Ref AppSecurityGroup
5
6# Allow specific port range from another SG
7SecurityGroupIngress:
8  - IpProtocol: tcp
9    FromPort: 8080
10    ToPort: 8090
11    SourceSecurityGroupId: !GetAtt AppSecurityGroup.GroupId

IPv6 Support

yaml
1SecurityGroupIngress:
2  # IPv4 all traffic
3  - IpProtocol: "-1"
4    CidrIp: 0.0.0.0/0
5  # IPv6 all traffic
6  - IpProtocol: "-1"
7    CidrIpv6: ::/0

Port Range Syntax

yaml
1SecurityGroupIngress:
2  # Single port
3  - IpProtocol: tcp
4    FromPort: 443
5    ToPort: 443
6    CidrIp: 0.0.0.0/0
7
8  # Port range (e.g., ephemeral ports)
9  - IpProtocol: tcp
10    FromPort: 1024
11    ToPort: 65535
12    CidrIp: 10.0.0.0/8
13
14  # All ports for a specific protocol
15  - IpProtocol: tcp
16    FromPort: 0
17    ToPort: 65535
18    CidrIp: 10.0.0.0/8

CDK Equivalent (TypeScript)

typescript
1import * as ec2 from 'aws-cdk-lib/aws-ec2';
2
3const sg = new ec2.SecurityGroup(this, 'MySG', {
4  vpc,
5  description: 'Allow all traffic',
6});
7
8// All traffic from a CIDR
9sg.addIngressRule(ec2.Peer.ipv4('10.0.0.0/8'), ec2.Port.allTraffic());
10
11// All TCP ports
12sg.addIngressRule(ec2.Peer.ipv4('10.0.0.0/8'), ec2.Port.allTcp());
13
14// All UDP ports
15sg.addIngressRule(ec2.Peer.ipv4('10.0.0.0/8'), ec2.Port.allUdp());
16
17// Specific port range
18sg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcpRange(8080, 8090));

Common Pitfalls

  • Specifying FromPort/ToPort with IpProtocol "-1": When using IpProtocol: "-1" (all traffic), do NOT include FromPort or ToPort. CloudFormation will throw a validation error. The all-protocol rule implicitly covers all ports.
  • Using 0.0.0.0/0 for ingress in production: Allowing all traffic from 0.0.0.0/0 on ingress opens your instances to the entire internet. Restrict CIDR ranges to known IP ranges, VPN addresses, or use security group references to limit access to other AWS resources.
  • Forgetting egress rules: Security groups have a default egress rule allowing all outbound traffic. If you explicitly define any egress rule in CloudFormation, the default is removed. If you only add one egress rule, all other outbound traffic is blocked.
  • String vs number for IpProtocol: IpProtocol must be a string. Use "-1" (quoted) not -1 (number). Using an unquoted -1 may cause YAML parsing issues, though most parsers handle it. For safety, always quote protocol values.
  • Security group rule limits: Each security group can have up to 60 inbound and 60 outbound rules by default (adjustable via AWS support). Using "all ports" rules (IpProtocol: "-1") counts as one rule, while listing individual ports uses one rule per entry.

Summary

  • Use IpProtocol: "-1" for all protocols and all ports (equivalent to "All traffic" in the Console)
  • Use FromPort: 0, ToPort: 65535 with tcp or udp for all ports of a specific protocol
  • Do NOT specify FromPort/ToPort when IpProtocol is "-1"
  • Use SourceSecurityGroupId to allow traffic from other security groups instead of CIDR ranges
  • Restrict CidrIp to specific networks in production — avoid 0.0.0.0/0 for ingress rules
Related reading
Course
Beginner
27 lessons
10 hours
System Design Fundamentals

Build a strong foundation in designing scalable, reliable distributed systems.

View the course
Track what you have practised

A free account saves your progress, solutions and study plan across every problem on Codemia.

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
Codemia
© 2026 Codemia
Resources
Legal
Social
All Rights Reserved.