Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389

regs=$(aliyun ecs DescribeRegions 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$regs" | sed -n 's/.*"RegionId"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | sort -u)
[ -n "$regions" ] || exit 1
bad=0
for r in $regions; do
  page=1
  while :; do
    sgs=$(aliyun ecs DescribeSecurityGroups --RegionId "$r" --PageSize 50 --PageNumber "$page" 2>/dev/null) || exit 1
    ids=$(printf '%s\n' "$sgs" | sed -n 's/.*"SecurityGroupId"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
    [ -n "$ids" ] || break
    for g in $ids; do
      rules=$(aliyun ecs DescribeSecurityGroupAttribute --RegionId "$r" --SecurityGroupId "$g" --Direction ingress 2>/dev/null) || exit 1
      n=$(printf '%s\n' "$rules" | awk -v port=3389 '
function v(s) { sub(/^[^:]*:[[:space:]]*"?/, "", s); sub(/"?,?[[:space:]]*$/, "", s); return s }
function open(s,   a) { if (split(s, a, "/") != 2) return 0; if (a[1] + 0 == -1) return 1; return a[1] + 0 <= port && a[2] + 0 >= port }
/\{/ { pr = ""; pt = ""; src = ""; src6 = ""; pol = "" }
/"IpProtocol"/ { pr = toupper(v($0)) }
/"PortRange"/ { pt = v($0) }
/"SourceCidrIp"/ { src = v($0) }
/"Ipv6SourceCidrIp"/ { src6 = v($0) }
/"Policy"/ { pol = tolower(v($0)) }
/\}/ { if ((src == "0.0.0.0/0" || src6 == "::/0") && pol != "drop" && (pr == "ALL" || pr == "TCP" || pr == "UDP") && open(pt)) n++ }
END { print n + 0 }')
      [ "$n" -eq 0 ] || { echo "port 3389 open to the Internet: $r $g"; bad=1; }
    done
    set -- $ids
    [ "$#" -lt 50 ] && break
    page=$((page + 1))
  done
done
[ "$bad" -eq 0 ] && echo compliant

tmaegis scan --target alibaba