Control: 18 Security groups should only allow unrestricted incoming traffic for authorized ports

Description

This control checks whether the security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter.

If the security group rule port number allows unrestricted incoming traffic, but the port number is specified in authorizedTcpPorts, then the control passes. The default value for authorizedTcpPorts is 80, 443.
If the security group rule port number allows unrestricted incoming traffic, but the port number is not specified in authorizedTcpPorts input parameter, then the control fails.
If the parameter is not used, then the control fails for any security group that has an unrestricted inbound rule.

Security groups provide stateful filtering of ingress and egress network traffic to AWS. Security group rules should follow the principal of least privileged access. Unrestricted access (IP address with a /0 suffix) increases the opportunity for malicious activity such as hacking, denial-of-service attacks, and loss of data.

Remediation

For information on how to modify a security group, see Add, remove, or update rules.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_ec2_18

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_ec2_18 --share

SQL

This control uses a named query:

with ingress_unauthorized_ports as (
  select
    group_id,
    count(*)
  from
    aws_vpc_security_group_rule
  where
    type = 'ingress'
    and cidr_ipv4 = '0.0.0.0/0'
    and (from_port is null or from_port not in (80,443))
  group by
    group_id
)
select
  sg.arn as resource,
  case
    when ingress_unauthorized_ports.count > 0 then 'alarm'
    else 'ok'
  end as status,
  case
    when ingress_unauthorized_ports.count > 0 then sg.title || ' having unrestricted incoming traffic other than default ports from 0.0.0.0/0 '
    else sg.title || ' allows unrestricted incoming traffic for authorized default ports (80,443).'
  end as reason
  
  , sg.region, sg.account_id
from
  aws_vpc_security_group as sg
  left join ingress_unauthorized_ports on ingress_unauthorized_ports.group_id = sg.group_id;

Control: 18 Security groups should only allow unrestricted incoming traffic for authorized ports

Description

Remediation

Usage

SQL

Tags