We use AWS Inspector to identify risks with our AWS assets. Today I received a finding, with a "high" severity. The finding said that the FTP port was open to the internet. However, after reviewing the security group associated with the instance, I saw that the FTP port is only open to a set of whitelisted IP addresses that are trusted.
Does this really constitute a high severity in your opinion? Is it problematic to open ports to the internet with a specific set of whitelisted IPs?