turbot/steampipe-mod-aws-compliance

Control: 4.2 Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389

Description

Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to port 3389.

Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.

Remediation

Perform the following to implement the prescribed state:

  1. Login to the AWS Management Console.
  2. In the left pane, click Security Groups.
  3. For each security group, perform the following:
  4. Select the security group.
  5. Click the Inbound Rules tab
  6. Identify the rules to be removed.
  7. Click the x in the Remove column.
  8. Click Save.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v120_4_2

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v120_4_2 --share

SQL

This control uses a named query:

with ingress_rdp_rules as (
select
group_id,
count(*) as num_rdp_rules
from
aws_vpc_security_group_rule
where
type = 'ingress'
and cidr_ipv4 = '0.0.0.0/0'
and (
( ip_protocol = '-1'
and from_port is null
)
or (
from_port <= 3389
and to_port >= 3389
)
)
group by
group_id
)
select
arn as resource,
case
when ingress_rdp_rules.group_id is null then 'ok'
else 'alarm'
end as status,
case
when ingress_rdp_rules.group_id is null then sg.group_id || ' ingress restricted for RDP from 0.0.0.0/0.'
else sg.group_id || ' contains ' || ingress_rdp_rules.num_rdp_rules || ' ingress rule(s) allowing RDP from 0.0.0.0/0.'
end as reason
, sg.region, sg.account_id
from
aws_vpc_security_group as sg
left join ingress_rdp_rules on ingress_rdp_rules.group_id = sg.group_id;

Tags