Control: 4.3 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22

Description

Security groups provide stateful filtering of ingress/egress network traffic to Alibaba Cloud resources. It is recommended that no security group allows unrestricted ingress access to port 22.

Remediation

From Console

Logon to ECS Console.
In the left pane, click to expand Network and Security, click Security Groups.
For each security group, perform the following:
- Select the security group.
- Click Add Rules.
- Click the Inbound tab.
- Identify the rules to be removed.
- Click Delete in the Remove column.
- Click OK.

Usage

Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v100_4_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v100_4_3 --share

SQL

This control uses a named query:

with bad_groups as (
  select
    distinct arn
  from
    alicloud_ecs_security_group,
    jsonb_array_elements(permissions) as p
  where
    p ->> 'Policy' = 'Accept'
    and p ->> 'Direction' = 'ingress'
    and p ->> 'SourceCidrIp' = '0.0.0.0/0'
    and (
      p ->> 'PortRange' in ('-1/-1', '22/22')
      or (22 between split_part(p ->> 'PortRange', '/', 1) :: int and split_part(p ->> 'PortRange', '/', 2) :: int)
    )
)
select
  a.arn as resource,
  case
    when b.arn is null then 'ok'
    else 'alarm'
  end as status,
  case
    when b.arn is null then a.security_group_id || ' does not allow ingress from 0.0.0.0/0 to port 22.'
    else a.security_group_id || ' allow ingress from 0.0.0.0/0 to port 22.'
  end as reason
  
  , a.account_id as account_id, a.region as region
from
  alicloud_ecs_security_group as a
  left join bad_groups as b on a.arn = b.arn;

Control: 4.3 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22

Description

Remediation

From Console

Usage

SQL

Tags