Unrestricted HTTPS Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP port 443 (HTTPS).Risk Level
LowAddress
SecurityCompliance Standards
AWSWAF, SOC2, GDPRTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Unrestricted HTTPS Access Should Not Be Allowed” misconfiguration in AWS, you can follow these steps:
- Log in to the AWS Management Console.
- Navigate to the AWS EC2 service.
- Click on the “Security Groups” option from the left-hand menu.
- Select the security group that is associated with the instance(s) that have unrestricted HTTPS access.
- Click on the “Inbound Rules” tab.
- Locate the HTTPS rule that has unrestricted access (i.e., source is set to “0.0.0.0/0” or ”::/0”).
- Click on the “Edit” button for the rule.
- Change the source to a more restrictive IP range or security group that requires HTTPS access.
- Click on the “Save Rules” button to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration of unrestricted HTTPS access in AWS using AWS CLI, follow these steps:Step 1: Open the AWS CLI in your terminal or command prompt.Step 2: Run the following command to list all the security groups in your AWS account:Step 3: Identify the security group(s) that have unrestricted HTTPS access allowed.Step 4: Run the following command to remove the HTTPS access rule from the identified security group(s):Note: Replace Note: Replace
<security_group_id> with the actual ID of the security group that needs to be remediated.Step 5: Verify that the HTTPS access rule has been removed by running the following command:<security_group_id> with the actual ID of the security group that was remediated.Step 6: Repeat the above steps for all the security groups that have unrestricted HTTPS access allowed.By following the above steps, you can remediate the misconfiguration of unrestricted HTTPS access in AWS using AWS CLI.Using Python
Using Python
To remediate the unrestricted HTTPS access issue in AWS using Python, you can follow the below steps:Note: Replace the
- Identify the Security Group(s) which are allowing unrestricted HTTPS access.
- Using the AWS SDK for Python (Boto3), modify the inbound rules of the identified Security Group(s) to allow HTTPS access only from trusted sources.
- Create a script to automate this process for all the Security Group(s) in your AWS account.
region and security_group_id variables with your own values. Also, replace the trusted_ip_address with the IP address(es) of the trusted sources that should be allowed HTTPS access.