Control: Security groups should not allow unrestricted access to ports with high risk
Description
This control checks whether unrestricted incoming traffic for the security groups is accessible to the specified ports that have the highest risk. This control passes when none of the rules in a security group allow ingress traffic from 0.0.0.0/0 for those ports.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.vpc_security_group_restricted_common_ports
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.vpc_security_group_restricted_common_ports --share
SQL
This control uses a named query:
with ingress_ssh_rules as ( select group_id, count(*) as num_ssh_rules from aws_vpc_security_group_rule where type = 'ingress' and cidr_ipv4 = '0.0.0.0/0' and ( ( ip_protocol = '-1' and from_port is null ) or ( from_port <= 22 and to_port >= 22 ) or ( from_port <= 3389 and to_port >= 3389 ) or ( from_port <= 21 and to_port >= 21 ) or ( from_port <= 20 and to_port >= 20 ) or ( from_port <= 3306 and to_port >= 3306 ) or ( from_port <= 4333 and to_port >= 4333 ) or ( from_port <= 23 and to_port >= 23 ) or ( from_port <= 25 and to_port >= 25 ) or ( from_port <= 445 and to_port >= 445 ) or ( from_port <= 110 and to_port >= 110 ) or ( from_port <= 135 and to_port >= 135 ) or ( from_port <= 143 and to_port >= 143 ) or ( from_port <= 1433 and to_port >= 3389 ) or ( from_port <= 3389 and to_port >= 1434 ) or ( from_port <= 5432 and to_port >= 5432 ) or ( from_port <= 5500 and to_port >= 5500 ) or ( from_port <= 5601 and to_port >= 5601 ) or ( from_port <= 9200 and to_port >= 9300 ) or ( from_port <= 8080 and to_port >= 8080 ) ) group by group_id)select arn as resource, case when ingress_ssh_rules.group_id is null then 'ok' else 'alarm' end as status, case when ingress_ssh_rules.group_id is null then sg.group_id || ' ingress restricted for common ports from 0.0.0.0/0..' else sg.group_id || ' contains ' || ingress_ssh_rules.num_ssh_rules || ' ingress rule(s) allowing access for common ports from 0.0.0.0/0.' end as reason , sg.region, sg.account_idfrom aws_vpc_security_group as sg left join ingress_ssh_rules on ingress_ssh_rules.group_id = sg.group_id;