Default Security Group Should Not Allow Unrestricted Public Traffic
More Info:
Default security groups should restrict all public traffic to follow AWS security best practices.Risk Level
LowAddress
SecurityCompliance Standards
CISAWS, CBP, NIST, SOC2, PCIDSS, GDPR, AWSWAF, NISTCSF, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Default Security Group Should Not Allow Unrestricted Public Traffic” for AWS using the AWS console, follow the steps below:
- Log in to the AWS Management Console.
- Navigate to the EC2 service.
- In the left-hand menu, click on “Security Groups”.
- Select the default security group.
- In the “Inbound Rules” tab, remove any rules that allow unrestricted public traffic (i.e. 0.0.0.0/0).
- Add specific rules for the required ports and protocols to allow traffic only from authorized sources.
- Review and save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Default Security Group Should Not Allow Unrestricted Public Traffic” for AWS using AWS CLI, follow the below steps:
- Open the AWS CLI on your local machine.
-
Run the following command to get the ID of the default security group in your AWS account:
-
Run the following command to update the inbound rules of the default security group to allow only necessary traffic:
This command will remove all the inbound rules that allow unrestricted public traffic.
-
Now, add the necessary inbound rules to the default security group using the following command:
Replace
<port-number>with the port number you want to allow traffic for and<ip-address>with the IP address range you want to allow traffic from. - Repeat step 4 for all the necessary inbound rules.
-
Verify the updated inbound rules of the default security group using the following command:
This command will display the updated inbound rules for the default security group.
Using Python
Using Python
To remediate the misconfiguration of default security group allowing unrestricted public traffic in AWS using Python, you can follow these steps:This should remediate the misconfiguration of default security group allowing unrestricted public traffic in AWS using Python.
- Import the necessary AWS SDK libraries and modules in Python.
- Create a connection to the AWS EC2 service using the boto3 library.
- Get the default security group ID using the describe_security_groups() method.
- Revoke the ingress rules that allow unrestricted public traffic using the revoke_security_group_ingress() method.
- Confirm that the ingress rules have been revoked by describing the security group again.