Control: 2 VPC default security groups should not allow inbound or outbound traffic
Description
This control checks that the default security group of a VPC does not allow inbound or outbound traffic.
It does not check for access restrictions for other security groups that are not default, and other VPC configurations.
Remediation
To remediate this issue, create new security groups and assign those security groups to your resources. To prevent the default security groups from being used, remove their inbound and outbound rules.
- Open the Amazon VPC console.
- In the navigation pane, choose
Security groups. View thedefault security groupsdetails to see the resources that are assigned to them. - Select a default security group, and choose the Inbound rules tab. Choose Edit inbound rules. Then delete all of the inbound rules. Choose Save rules.
- Repeat the previous step for each default security group.
- Select a default security group and choose the Outbound rules tab. Choose Edit outbound rules. Then delete all of the outbound rules. Choose Save rules.
- Repeat the previous step for each default security group.
Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the Amazon VPC User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_ec2_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_ec2_2 --shareSQL
This control uses a named query:
vpc_default_security_group_restricts_all_traffic