Firewall Review Report - Horizon - 2026
Review Information
- Reviewers:
- Date of Review: September 17, 2026
- Next Scheduled Review: September 2027
Review Coverage
This review covered the AWS Security Group configurations and associated firewall infrastructure for all Horizon AI cloud environments and endpoints.
Ruleset Overview
The review focused on AWS Security Group configurations managing both inbound and outbound traffic rules across Horizon AI's cloud infrastructure. Additional security layers including AWS WAF and GuardDuty configurations were also evaluated.
Review Findings
Current Firewall Rulesets/Configurations
AWS Security Groups
The current infrastructure utilizes 28 active Security Groups (up from 9 in the August 2025 review), per the AWS Security Groups export dated September 17, 2026:
Outbound Rules:
- 24 of the 28 Security Groups are configured with unrestricted outbound access (Protocol: -1, Destination: 0.0.0.0/0).
- Scoped outbound exceptions: sg-0605097b9a988ebd5 (rdsproxy-lambda-1, TCP 5432 to RDS), sg-0f6315edff07be7df (lambda-rdsproxy-1, TCP 5432/443 to RDS Proxy and an AWS service prefix list), sg-03e15f826fd8f4614 (NFS egress, TCP 988/1018-1023/2049 to its paired NFS security group), and sg-0e3bf4387082eaa5f (Datadog Agentless Scanning, TCP 0-65535 to 0.0.0.0/0 and ::/0).
Inbound Rules — open to the internet (0.0.0.0/0):
- sg-0cf9c7a2724787537 (GS-horizon-AI-Inference-alb): HTTP (80) and HTTPS (443)
- sg-0215c90683535b093 (SG-horizon-backend-alb): HTTP (80), HTTPS (443), and custom port 8088
- sg-04db6c49a82bdb4b1 (proxy-server-security-group): HTTP (80) and HTTPS (443); SSH (22) restricted to 2 specific IPs