Control: 6.4 Ensure no security groups allow ingress from ::/0 to remote server administration ports

Description

Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port 22 and RDP on port 3389.

Remediation

From Console:

Perform the following to implement the prescribed state:

Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
In the left pane, click Security Groups.
For each security group, perform the following:

Select the security group.
Click the Inbound Rules tab.
Click the Edit inbound rules button.
Identify the rules to be edited or removed.
Either (A) update the Source field to a range other than ::/0, or (B) Click Delete to remove the offending inbound rule.
Click Save rules.

From Command Line:

Check all security groups for insecure inbound rules that allow traffic from ::/0 .

aws ec2 describe-security-group-rules --query 'SecurityGroupRules[?CidrIpv6 == `::/0` && IsEgress == `false`]' --output json

Delete the insecure rule(s) based on the rule ID:

aws ec2 delete-security-group-rules --group-id <security_group_id> --security-group-rule-ids <rule_id_to_delete>

Recreate necessary security group rules:

aws ec2 authorize-security-group-ingress --group-id <security_group_id> --protocol <tcp, udp, icmp or all> --port <port_number> --cidr <source_cidr>

Default Value:

By default, security groups may allow unrestricted IPv6 ingress (::/0) on ports like SSH (22) or RDP (3389). AWS does not block this automatically; restrictions must be applied manually.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v600_6_4

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v600_6_4 --share

SQL

This control uses a named query:

with bad_rules as (
  select
    group_id,
    count(*) as num_bad_rules
  from
    aws_vpc_security_group_rule
  where
    type = 'ingress'
    and (
      cidr_ipv6 = '::/0'
    )
    and (
        ( ip_protocol = '-1'      -- all traffic
        and from_port is null
        )
        or (
            from_port <= 22
            and to_port >= 22
        )
        or (
            from_port <= 3389
            and to_port >= 3389
        )
    )
  group by
    group_id
)
select
  arn as resource,
  case
    when bad_rules.group_id is null then 'ok'
    else 'alarm'
  end as status,
  case
    when bad_rules.group_id is null then sg.group_id || ' does not allow ingress to port 22 or 3389 from ::/0.'
    else  sg.group_id || ' contains ' || bad_rules.num_bad_rules || ' rule(s) that allow ingress to port 22 or 3389 from ::/0.'
  end as reason
  
  , sg.region, sg.account_id
from
  aws_vpc_security_group as sg
  left join bad_rules on bad_rules.group_id = sg.group_id;