Security group counts remediation

Using Console

Excessive counts in Security Groups could indicate that there are too many rules in a single Security Group, which can lead to security risks and complexity in managing the rules. To remediate this issue in AWS using the AWS console, follow these steps:

Log in to the AWS Management Console and navigate to the EC2 dashboard.
Select the Security Group that has excessive counts.
Click on the “Edit inbound rules” button to modify the rules.
Review the rules and identify any redundant or unnecessary rules.
Remove any redundant or unnecessary rules by clicking on the “X” button next to each rule.
Consolidate similar rules by combining them into a single rule.
Click on the “Save rules” button to save the changes.

By following these steps, you should be able to remediate the excessive counts in the Security Group and reduce the risk of security breaches.

Using CLI

The Security Group Excessive Counts issue occurs when a security group has too many rules, which can lead to performance issues and make it difficult to manage the security group. To remediate this issue in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your computer.
Use the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

Identify the security group that has too many rules.
Use the following command to get the details of the security group:

aws ec2 describe-security-groups --group-ids <security-group-id>

Review the rules and identify any rules that are not necessary or duplicates.
Use the following command to delete the unnecessary rules:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --ip-permissions <ip-permissions>

Replace <security-group-id> with the ID of the security group that has too many rules.
Replace <ip-permissions> with the IP permissions of the rule that you want to delete. You can get the IP permissions from the output of the previous command.
Repeat steps 6 to 8 for all the unnecessary rules.
Use the following command to confirm that the rules have been deleted:

aws ec2 describe-security-groups --group-ids <security-group-id>

Verify that the security group no longer has excessive counts.

Note: Make sure to test the security group after making changes to ensure that it is still functioning as expected.

Using Python

To remediate Security Group Excessive Counts in AWS using python, you can follow these steps:

Identify the security groups with excessive counts by using the describe_security_groups method from the boto3 library in python. This method will return a list of all the security groups in your AWS account. You can then iterate through this list to identify the security groups with excessive counts.
Once you have identified the security groups with excessive counts, you can use the revoke_ingress method to remove unnecessary inbound rules. This method takes in the GroupId parameter to identify the security group and the IpPermissions parameter to specify the inbound rules to be removed.
After removing the unnecessary inbound rules, you can use the authorize_ingress method to add the necessary inbound rules. This method takes in the GroupId parameter to identify the security group and the IpPermissions parameter to specify the inbound rules to be added.

Here’s a sample code snippet that you can use as a starting point:

import boto3

# Create an EC2 client
ec2 = boto3.client('ec2')

# Get all security groups
security_groups = ec2.describe_security_groups()

# Iterate through security groups
for sg in security_groups['SecurityGroups']:
    # Check if security group has excessive counts
    if len(sg['IpPermissions']) > 50:
        # Remove unnecessary inbound rules
        ec2.revoke_ingress(
            GroupId=sg['GroupId'],
            IpPermissions=sg['IpPermissions']
        )
        # Add necessary inbound rules
        ec2.authorize_ingress(
            GroupId=sg['GroupId'],
            IpPermissions=[
                {
                    'IpProtocol': 'tcp',
                    'FromPort': 22,
                    'ToPort': 22,
                    'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
                },
                {
                    'IpProtocol': 'tcp',
                    'FromPort': 80,
                    'ToPort': 80,
                    'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
                }
            ]
        )

In this example, we are checking if a security group has more than 50 inbound rules and removing all the inbound rules using the revoke_ingress method. We are then adding two necessary inbound rules for SSH and HTTP using the authorize_ingress method. You can modify the code to suit your specific requirements.

Using Terraform

# Example of a SECURITY GROUP YOU ARE KEEPING
resource "aws_security_group" "PRIMARY_APP_SG" {
  name        = "primary-app-sg"
  description = "Primary application security group to keep"
  vpc_id      = aws_vpc.MY_VPC.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # EXAMPLE ONLY – RESTRICT AS NEEDED
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "PRIMARY_APP_SG"
  }
}

To actually perform the CLI-equivalent remediation in Terraform, you must delete the aws_security_group blocks for unused security groups entirely from your configuration (and ensure no other Terraform-managed resources reference them).This is destructive and irreversible and can cause outages if a security group is still in use or referenced; you must first use the AWS Console/CLI to verify it is not attached to any ENIs and not referenced by other security groups, and disassociate it everywhere before removing the resource blocks.Verification with Terraform: terraform plan should show each unused security group as:

- destroy for aws_security_group.UNUSED_SG_NAME and no new replacements being created.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Security group counts remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation