​
More Info:

This rule checks if an Amazon Elastic Compute Cloud (EC2) instance metadata has a specified token hop limit that is below the desired limit. The rule is NON_COMPLIANT for an instance if it has a hop limit value above the intended limit.

​
Risk Level

Low

​
Address

Configuration

​
Compliance Standards

CBP

​
Triage and Remediation

​
Remediation

Using Console

To remediate the EC2 Hop Limit Check misconfiguration for AWS EC2 using the AWS Management Console, follow these steps:
  1. Login to AWS Console: Visit the AWS Management Console (https://aws.amazon.com/console/) and log in with your credentials.
  2. Navigate to EC2 Service: Click on the “Services” dropdown menu at the top of the page and select “EC2” under the Compute section.
  3. Select the EC2 Instance: In the EC2 Dashboard, locate the EC2 instance for which you want to remediate the Hop Limit Check misconfiguration.
  4. Modify Security Group: Click on the “Security” link under the “Description” tab of the selected EC2 instance.
  5. Edit Inbound Rules: In the Security Group settings, locate the inbound rule that allows traffic to the EC2 instance.
  6. Update Inbound Rule: Edit the inbound rule to restrict the source IP addresses or CIDR range that can communicate with the EC2 instance. You can set the source IP address to a specific IP or CIDR block to limit the number of hops allowed.
  7. Save Changes: After updating the inbound rule, click on the “Save” or “Apply” button to apply the changes.
  8. Verify Configuration: Verify that the inbound rule has been updated successfully and that only authorized IP addresses or CIDR ranges can communicate with the EC2 instance.
By following these steps, you can remediate the EC2 Hop Limit Check misconfiguration for AWS EC2 using the AWS Management Console.

​

To remediate the EC2 Hop Limit Check misconfiguration for AWS EC2 using AWS CLI, you can follow these steps:
  1. Identify the affected EC2 instance: First, identify the EC2 instance(s) that are affected by the Hop Limit Check misconfiguration.
  2. Update the Security Group: You will need to update the security group associated with the affected EC2 instance(s) to allow the desired traffic. Specifically, you need to modify the inbound rules to allow traffic with the desired hop limit.
  3. Get the Security Group ID: Use the following AWS CLI command to get the security group ID associated with the affected EC2 instance: 
    aws ec2 describe-instances --instance-ids <instance-id> --query 'Reservations[*].Instances[*].SecurityGroups[*].[GroupId]' --output text
  4. Update the Security Group Inbound Rules: Use the following AWS CLI command to update the inbound rules of the security group to allow traffic with the desired hop limit. Replace <security-group-id> with the security group ID obtained in the previous step and <desired-hop-limit> with the desired hop limit value. 
    aws ec2 authorize-security-group-ingress --group-id <security-group-id> --ip-permissions '[{"IpProtocol": "icmp", "FromPort": <desired-hop-limit>, "ToPort": <desired-hop-limit>, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]'
  5. Verify the Security Group Rules: Run the following AWS CLI command to verify that the inbound rule has been updated successfully: 
    aws ec2 describe-security-groups --group-ids <security-group-id> --query 'SecurityGroups[*].IpPermissions'
  6. Test Connectivity: Finally, test the connectivity to ensure that the hop limit check misconfiguration has been remediated successfully.
By following these steps and updating the security group inbound rules to allow traffic with the desired hop limit, you can remediate the EC2 Hop Limit Check misconfiguration for AWS EC2 using AWS CLI.
To remediate the EC2 Hop Limit Check misconfiguration in AWS EC2 using Python, you can create a Lambda function that will periodically check the hop limit for all your EC2 instances and take appropriate actions. Here are the step-by-step instructions to remediate this misconfiguration:
  1. Create a Lambda Function:
    • Go to the AWS Management Console and navigate to the Lambda service.
    • Click on “Create function” and choose the option to author from scratch.
    • Provide a name for your function, select Python as the runtime, and choose an existing role with necessary permissions or create a new role.
    • Click on “Create function” to create the Lambda function.
  2. Add Code to Check Hop Limit:
    • In the Lambda function code editor, write Python code to describe instances and check the hop limit for each EC2 instance.
    • Use the Boto3 library to interact with AWS services. Install it using pip install boto3 if not already installed.
    • Use the describe_instances method to get information about all EC2 instances.
    • Check the hop limit for each instance by inspecting the “InstanceType” attribute.
  3. Take Remediation Actions:
    • If the hop limit is not compliant, you can modify the instance settings to comply with the desired hop limit.
    • Use the modify_instance_attribute method to update the hop limit for non-compliant instances.
  4. Set up Event Trigger:
    • Create a CloudWatch Events rule to trigger the Lambda function at a regular interval (e.g., every hour).
    • Configure the rule to trigger the Lambda function and set the schedule expression.
  5. Testing:
    • Test the Lambda function by manually triggering it and verifying that it correctly identifies and remediates the hop limit misconfigurations.
  6. Monitoring:
    • Set up CloudWatch Alarms to monitor the execution of the Lambda function and receive notifications in case of failures.
  7. Logging:
    • Implement logging within the Lambda function to track the hop limit checks and remediation actions taken for auditing purposes.
By following these steps, you can create a Python-based Lambda function that automatically remediates the EC2 Hop Limit Check misconfiguration in AWS EC2 instances.