Security Group Port Range
More Info:
Security groups should not have range of ports opened for inbound traffic in order to protect your EC2 instances against denial-of-service (DoS) attacks or brute-force attacks.Risk Level
LowAddress
SecurityCompliance Standards
HIPAA, NIST, SOC2, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
Here are the step-by-step instructions to remediate the Security Group Port Range misconfiguration for AWS using the AWS console:
- Log in to your AWS console.
- Navigate to the EC2 dashboard.
- Click on the “Security Groups” option on the left-hand side of the screen.
- Select the affected security group.
- Click on the “Inbound Rules” tab.
- Identify the rule with the incorrect port range.
- Click on the “Edit” button for that rule.
- Update the port range to the appropriate range.
- Click on the “Save” button to save the changes.
- Verify that the changes have been applied by confirming that the correct port range is now listed in the security group’s inbound rules.
Using CLI
Using CLI
The remediation steps for Security Group Port Range misconfiguration in AWS using AWS CLI are as follows:
-
Identify the security group that has the misconfigured port range. You can use the following command to list all the security groups in your AWS account:
-
Once you have identified the security group, use the following command to update the security group and remove the misconfigured port range:
Replace
<security-group-id>with the ID of the security group that has the misconfigured port range, and<port-range>with the range of ports that need to be removed. For example, if the security group ID issg-1234567890and the misconfigured port range is0-65535, the command would be: -
Verify that the misconfigured port range has been removed by using the following command to describe the security group:
Replace
<security-group-id>with the ID of the security group that you updated. Verify that the misconfigured port range is no longer listed in the security group rules.
Using Python
Using Python
To remediate the Security Group Port Range misconfiguration in AWS using Python, follow these steps:In this example, we are filtering the security groups based on the SSH port (port 22), but you can modify the code to filter based on other port ranges as well.In this example, we are allowing only HTTP (port 80) and HTTPS (port 443) traffic to the security groups that have the misconfigured port range. You can modify the code to allow other ports as well.In this example, we are checking that only HTTP (port 80) and HTTPS (port 443) traffic is allowed in the security groups that have the misconfigured port range. If any other port is still allowed, the code will print a message indicating that the security group still has a misconfigured port range.
- First, you need to identify the security group that has the misconfigured port range. You can do this by using the AWS SDK for Python (Boto3) to list all the security groups in your account and filter them based on the port range that is misconfigured.
- Once you have identified the security groups that have the misconfigured port range, you need to update the security group rules to allow only the required ports. You can do this by using the
authorize_security_group_ingressandrevoke_security_group_ingressmethods of theec2client.
- Finally, you should verify that the security group rules have been updated correctly. You can do this by using the
describe_security_groupsmethod of theec2client to retrieve the security group rules and checking that only the required ports are allowed.