Ensure no security groups allow ingress from ::/0 to remote server administration ports

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Perform the following to determine if the account is configured as prescribed: 1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home. 2. In the left pane, click Security Groups. 3. For each security group, perform the following: o Select the security group. o Click the Inbound Rules tab. o Ensure that no rule exists which has a port range including port 22, 3389, or other remote server administration ports for your environment, and has a Source of ::/0. Note: - A port value of ALL or a port range such as 0-3389 includes port 22, 3389, and potentially other remote server administration ports - Security groups are stateful and do not support explicit DENY rules. Therefore, an “effective ruleset” approach (e.g., allowing ANY/ANY but denying specific ports) is not applicable. Any rule that allows ::/0 access to administrative ports is considered non-compliant and must be removed or restricted

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

From Console: Perform the following to implement the prescribed state: 1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home. 2. In the left pane, click Security Groups. 3. For each security group, perform the following: o Select the security group. o Click the Inbound Rules tab. o Click the Edit inbound rules button. o Identify the rules to be edited or removed. o Either A) update the Source field to a range other than ::/0, or B) Click Delete to remove the offending inbound rule. o Click Save rules. From Command Line: 1. Check all security groups for insecure inbound rules that allow traffic from ::/0 . aws ec2 describe-security-group-rules --query 'SecurityGroupRules[?CidrIpv6 == `::/0` && IsEgress == `false`]' --output json 2. Delete the insecure rule(s) based on the rule ID: aws ec2 delete-security-group-rules --group-id <security_group_id> -- security-group-rule-ids <rule_id_to_delete> 3. Recreate necessary security group rules: aws ec2 authorize-security-group-ingress --group-id <security_group_id> -- protocol <tcp, udp, icmp or all> --port <port_number> --cidr <source_cidr>