Security Group Port Range Should Be Limited

Using Console

Here are the step-by-step instructions to remediate the Security Group Port Range misconfiguration for AWS using the AWS console:

Log in to your AWS console.
Navigate to the EC2 dashboard.
Click on the “Security Groups” option on the left-hand side of the screen.
Select the affected security group.
Click on the “Inbound Rules” tab.
Identify the rule with the incorrect port range.
Click on the “Edit” button for that rule.
Update the port range to the appropriate range.
Click on the “Save” button to save the changes.
Verify that the changes have been applied by confirming that the correct port range is now listed in the security group’s inbound rules.

It is recommended to regularly review and update security group rules to ensure that they are configured correctly for your organization’s needs.

Using CLI

The remediation steps for Security Group Port Range misconfiguration in AWS using AWS CLI are as follows:

Identify the security group that has the misconfigured port range. You can use the following command to list all the security groups in your AWS account:
aws ec2 describe-security-groups
Once you have identified the security group, use the following command to update the security group and remove the misconfigured port range:
aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port <port-range>
Replace <security-group-id> with the ID of the security group that has the misconfigured port range, and <port-range> with the range of ports that need to be removed. For example, if the security group ID is sg-1234567890 and the misconfigured port range is 0-65535, the command would be:
aws ec2 revoke-security-group-ingress --group-id sg-1234567890 --protocol tcp --port 0-65535
Verify that the misconfigured port range has been removed by using the following command to describe the security group:
aws ec2 describe-security-groups --group-id <security-group-id>
Replace <security-group-id> with the ID of the security group that you updated. Verify that the misconfigured port range is no longer listed in the security group rules.

By following these steps, you can remediate the Security Group Port Range misconfiguration in AWS using AWS CLI.

Using Python

To remediate the Security Group Port Range misconfiguration in AWS using Python, follow these steps:

First, you need to identify the security group that has the misconfigured port range. You can do this by using the AWS SDK for Python (Boto3) to list all the security groups in your account and filter them based on the port range that is misconfigured.

Here’s an example code snippet that lists all the security groups in your account and filters them based on a specific port range:

import boto3

# Create an EC2 client
ec2 = boto3.client('ec2')

# List all the security groups in your account
response = ec2.describe_security_groups()

# Filter the security groups based on the misconfigured port range
misconfigured_security_groups = []
for sg in response['SecurityGroups']:
    for rule in sg['IpPermissions']:
        if rule['FromPort'] == 22 and rule['ToPort'] == 22:
            misconfigured_security_groups.append(sg['GroupId'])

In this example, we are filtering the security groups based on the SSH port (port 22), but you can modify the code to filter based on other port ranges as well.

Once you have identified the security groups that have the misconfigured port range, you need to update the security group rules to allow only the required ports. You can do this by using the authorize_security_group_ingress and revoke_security_group_ingress methods of the ec2 client.

Here’s an example code snippet that updates the security group rules to allow only the required ports:

# Update the security group rules to allow only the required ports
for sg_id in misconfigured_security_groups:
    ec2.revoke_security_group_ingress(
        GroupId=sg_id,
        IpPermissions=[
            {
                'IpProtocol': 'tcp',
                'FromPort': 0,
                'ToPort': 65535,
                'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
            },
            {
                'IpProtocol': 'udp',
                'FromPort': 0,
                'ToPort': 65535,
                'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
            }
        ]
    )

    ec2.authorize_security_group_ingress(
        GroupId=sg_id,
        IpPermissions=[
            {
                'IpProtocol': 'tcp',
                'FromPort': 80,
                'ToPort': 80,
                'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
            },
            {
                'IpProtocol': 'tcp',
                'FromPort': 443,
                'ToPort': 443,
                'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
            }
        ]
    )

In this example, we are allowing only HTTP (port 80) and HTTPS (port 443) traffic to the security groups that have the misconfigured port range. You can modify the code to allow other ports as well.

Finally, you should verify that the security group rules have been updated correctly. You can do this by using the describe_security_groups method of the ec2 client to retrieve the security group rules and checking that only the required ports are allowed.

Here’s an example code snippet that verifies the updated security group rules:

# Verify that the security group rules have been updated correctly
for sg_id in misconfigured_security_groups:
    response = ec2.describe_security_groups(GroupIds=[sg_id])
    for rule in response['SecurityGroups'][0]['IpPermissions']:
        if rule['FromPort'] != 80 and rule['ToPort'] != 443:
            print(f"Security group {sg_id} still has misconfigured port range")

In this example, we are checking that only HTTP (port 80) and HTTPS (port 443) traffic is allowed in the security groups that have the misconfigured port range. If any other port is still allowed, the code will print a message indicating that the security group still has a misconfigured port range.

Using Terraform

resource "aws_security_group" "APP_SG" {
  name        = "APP_SG_NAME"                  # substitute: existing security group name
  description = "Security group for APP_NAME"  # substitute: description
  vpc_id      = "VPC_ID"                       # substitute: VPC ID where the SG lives

  # (do NOT define inline ingress here if you use aws_vpc_security_group_ingress_rule)
}

# REMOVE or edit any existing ingress rule in Terraform that defines the wide port range,
# for example something like 0-65535 or 1-65535, 0-1024, etc.
# Example of what to DELETE from your code (do not keep this block in your config):
#
# resource "aws_vpc_security_group_ingress_rule" "wide_range" {
#   security_group_id = aws_security_group.APP_SG.id
#   ip_protocol       = "tcp"
#   from_port         = 0
#   to_port           = 65535
#   cidr_ipv4         = "0.0.0.0/0"
# }

# ADD a new, more restrictive ingress rule instead, matching the required protocol,
# a specific port (or narrow range), and the intended source(s).
resource "aws_vpc_security_group_ingress_rule" "restricted_app_port" {
  security_group_id = aws_security_group.APP_SG.id

  ip_protocol = "tcp"                 # substitute: "<protocol>" from your use case
  from_port   = 443                   # substitute: <specific_port_or_narrow_from_port>
  to_port     = 443                   # substitute: <specific_port_or_narrow_to_port>

  cidr_ipv4 = "203.0.113.0/24"        # substitute: <source_cidr>, or use one of:
  # referenced_security_group_id = "SOURCE_SG_ID"  # substitute: if source is another SG

  description = "Allow HTTPS from corporate CIDR"  # substitute: useful description
}

Changing the rule this way mirrors the CLI remediation: it revokes the wide <from_port>-<to_port> rule and authorizes a narrower <specific_port_or_range> from the intended source; this can disrupt connectivity if you remove ports the application actually needs, so validate requirements first.terraform plan should show the original wide aws_vpc_security_group_ingress_rule being destroyed (or its from_port/to_port/source arguments changing) and a new or updated aws_vpc_security_group_ingress_rule with the restricted port or narrow range being created/applied, while the aws_security_group itself remains in place.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Security Group Port Range Should Be Limited

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: