Unrestricted HTTP Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP port 80 (HTTP).Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, GDPR, AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of unrestricted HTTP access in AWS, you can follow the below steps:
- Login to your AWS console.
- Go to the EC2 dashboard.
- Click on the “Security Groups” option on the left-hand side menu.
- Select the security group that is associated with the instance that has unrestricted HTTP access.
- Click on the “Inbound Rules” tab.
- Find the rule that allows unrestricted HTTP access (port 80).
- Click on the “Edit” button for that rule.
- Change the source from “0.0.0.0/0” to a specific IP address or range of IP addresses that you want to allow access from.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the “Unrestricted HTTP Access Should Not Be Allowed” misconfiguration in AWS using AWS CLI, you can follow the below steps:
- Open the AWS CLI on your local machine.
-
Run the following command to list all the security groups in your AWS account:
- Identify the security group that has unrestricted HTTP access. You can do this by looking for security groups that have port 80 open to the entire internet (0.0.0.0/0).
-
Once you have identified the security group, run the following command to update the inbound rules of the security group to only allow HTTP access from specific IP addresses or CIDR blocks:
Note: Replace
<security-group-id>with the ID of the security group that you want to remediate. -
After running the above command, you can verify that the inbound rule for port 80 has been updated by running the following command:
Note: Replace
<security-group-id>with the ID of the security group that you updated. - Verify that the inbound rule for port 80 is now restricted to specific IP addresses or CIDR blocks.
Using Python
Using Python
To remediate the unrestricted HTTP access misconfiguration in AWS using Python, you can follow these steps:In the above code, replace
- Identify the security group(s) associated with the EC2 instance(s) that have unrestricted HTTP access.
- Use the AWS SDK for Python (boto3) to modify the inbound rules of the security group(s) to allow HTTP access only from trusted sources.
<SECURITY_GROUP_ID> with the ID of the security group that needs to be remediated and <TRUSTED_CIDR> with the CIDR block of the trusted source that should have HTTP access to the EC2 instance(s).Note: Make sure to test this code in a non-production environment before applying it to a production environment.