Control: 4.1 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22
Description
Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to port 22.
Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.
Remediation
Perform the following to implement the prescribed state:
- Login to the AWS Management Console.
- In the left pane, click
Security Groups
. - For each security group, perform the following:
- Select the security group.
- Click the
Inbound Rule
s tab. - Identify the rules to be removed.
- Click the x in the
Remove
column. - Click
Save
.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v120_4_1
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v120_4_1 --share
SQL
This control uses a named query:
with ingress_ssh_rules as ( select group_id, count(*) as num_ssh_rules from aws_vpc_security_group_rule where type = 'ingress' and cidr_ipv4 = '0.0.0.0/0' and ( ( ip_protocol = '-1' and from_port is null ) or ( from_port <= 22 and to_port >= 22 ) ) group by group_id)select arn as resource, case when ingress_ssh_rules.group_id is null then 'ok' else 'alarm' end as status, case when ingress_ssh_rules.group_id is null then sg.group_id || ' ingress restricted for SSH from 0.0.0.0/0.' else sg.group_id || ' contains ' || ingress_ssh_rules.num_ssh_rules || ' ingress rule(s) allowing SSH from 0.0.0.0/0.' end as reason , region, account_idfrom aws_vpc_security_group as sg left join ingress_ssh_rules on ingress_ssh_rules.group_id = sg.group_id;