Security Groups Should Not Allow Inbound Traffic From RFC 1918
More Info:
No EC2 security group should allow inbound traffic from RFC-1918 CIDRs in order to follow AWS security best practices.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the misconfiguration “Security Groups Should Not Allow Inbound Traffic From RFC 1918” for AWS using the AWS console:
- Log in to the AWS Management Console.
- Navigate to the EC2 service.
- Click on “Security Groups” from the left-hand menu.
- Select the security group that needs to be remediated.
- Click on the “Inbound Rules” tab.
- Identify the inbound rule(s) that allow traffic from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16).
- Click on the “Edit” button for the rule that needs to be remediated.
- Change the “Source” field to a specific IP address or range that is allowed to access the resource(s) protected by the security group.
- Alternatively, you can also change the “Source” field to “Custom” and enter an IP address or range that is not part of RFC 1918.
- Click on the “Save rules” button to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Security Groups Should Not Allow Inbound Traffic From RFC 1918” for AWS using AWS CLI, you can follow the below steps:Step 1: Identify the Security Group(s) that allow inbound traffic from RFC 1918 IP addresses.This command will list all the security groups that allow inbound traffic from RFC 1918 IP addresses.Step 2: Revoke the Inbound Rule from the Security Group(s) identified in Step 1.Replace Replace
<security-group-id> with the ID of the security group, <port-number> with the port number that is open to RFC 1918 IP addresses, and <RFC 1918 IP address range> with the appropriate RFC 1918 IP address range.Repeat this command for each security group identified in Step 1.Step 3: Verify that the Inbound Rule has been revoked.<security-group-id> with the ID of the security group.This command will list all the inbound rules for the security group. Verify that the rule allowing inbound traffic from RFC 1918 IP addresses has been revoked.Repeat this command for each security group identified in Step 1.By following these steps, you can remediate the misconfiguration “Security Groups Should Not Allow Inbound Traffic From RFC 1918” for AWS using AWS CLI.Using Python
Using Python
To remediate the misconfiguration of Security Groups allowing inbound traffic from RFC 1918 in AWS using Python, follow these steps:
- List all the security groups in your AWS account using the
describe_security_groupsmethod from theboto3library.
- Iterate through the security groups and for each security group, check if it allows inbound traffic from RFC 1918. If it does, update the security group to remove the rule.
- After running the script, all the security groups that allow inbound traffic from RFC 1918 will be updated to remove the rule.