Control: VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to memcached port 11211

Description

This control checks whether the VPC security groups that are in use allow allow ingress from 0.0.0.0/0 or ::/0 to memcached port 11211. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. This control passes when none of the rules in a security group allow ingress traffic from 0.0.0.0/0 from port 11211.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.vpc_security_group_allows_ingress_to_memcached_port

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.vpc_security_group_allows_ingress_to_memcached_port --share

SQL

This control uses a named query:

with ingress_ssh_rules as (
  select
    group_id,
    count(*) as num_ssh_rules
  from
    aws_vpc_security_group_rule
  where
    type = 'ingress'
    and cidr_ipv4 = '0.0.0.0/0'
    and (
        ( ip_protocol = '-1'
        and from_port is null
        )
        or (
            from_port <= 11211
            and to_port >= 11211
        )
    )
  group by
    group_id
)
select
  arn as resource,
  case
    when ingress_ssh_rules.group_id is null then 'ok'
    else 'alarm'
  end as status,
  case
    when ingress_ssh_rules.group_id is null then sg.group_id || ' ingress restricted for memcached port from 0.0.0.0/0.'
    else sg.group_id || ' contains ' || ingress_ssh_rules.num_ssh_rules || ' ingress rule(s) allowing access for memcached port from 0.0.0.0/0.'
  end as reason
  
  , sg.region, sg.account_id
from
  aws_vpc_security_group as sg
  left join ingress_ssh_rules on ingress_ssh_rules.group_id = sg.group_id;

Control: VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to memcached port 11211

Description

Usage

SQL

Tags