Unrestricted HTTPS Access Should Not Be Allowed

Using Console

To remediate the “Unrestricted HTTPS Access Should Not Be Allowed” misconfiguration in AWS, you can follow these steps:

Log in to the AWS Management Console.
Navigate to the AWS EC2 service.
Click on the “Security Groups” option from the left-hand menu.
Select the security group that is associated with the instance(s) that have unrestricted HTTPS access.
Click on the “Inbound Rules” tab.
Locate the HTTPS rule that has unrestricted access (i.e., source is set to “0.0.0.0/0” or ”::/0”).
Click on the “Edit” button for the rule.
Change the source to a more restrictive IP range or security group that requires HTTPS access.
Click on the “Save Rules” button to apply the changes.

Note: If you are unsure which security group is associated with the instance(s) that have unrestricted HTTPS access, you can view the instance details to find the security group ID and then navigate to the Security Groups section to find the security group.

Using CLI

To remediate the misconfiguration of unrestricted HTTPS access in AWS using AWS CLI, follow these steps:Step 1: Open the AWS CLI in your terminal or command prompt.Step 2: Run the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

Step 3: Identify the security group(s) that have unrestricted HTTPS access allowed.Step 4: Run the following command to remove the HTTPS access rule from the identified security group(s):

aws ec2 revoke-security-group-ingress --group-id <security_group_id> --protocol tcp --port 443 --cidr 0.0.0.0/0

Note: Replace <security_group_id> with the actual ID of the security group that needs to be remediated.Step 5: Verify that the HTTPS access rule has been removed by running the following command:

aws ec2 describe-security-groups --group-id <security_group_id>

Note: Replace <security_group_id> with the actual ID of the security group that was remediated.Step 6: Repeat the above steps for all the security groups that have unrestricted HTTPS access allowed.By following the above steps, you can remediate the misconfiguration of unrestricted HTTPS access in AWS using AWS CLI.

Using Python

To remediate the unrestricted HTTPS access issue in AWS using Python, you can follow the below steps:

Identify the Security Group(s) which are allowing unrestricted HTTPS access.
Using the AWS SDK for Python (Boto3), modify the inbound rules of the identified Security Group(s) to allow HTTPS access only from trusted sources.
Create a script to automate this process for all the Security Group(s) in your AWS account.

Here is a sample Python code to remediate the issue:

import boto3

# Define the AWS region and security group id
region = 'us-east-1'
security_group_id = 'sg-0123456789abcdef'

# Create an EC2 client
ec2 = boto3.client('ec2', region_name=region)

# Get the existing inbound rules of the security group
response = ec2.describe_security_groups(GroupIds=[security_group_id])

# Modify the inbound rules to allow HTTPS access only from trusted sources
ec2.authorize_security_group_ingress(
    GroupId=security_group_id,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 443,
            'ToPort': 443,
            'IpRanges': [
                {
                    'CidrIp': 'trusted_ip_address/32'
                }
            ]
        }
    ]
)

Note: Replace the region and security_group_id variables with your own values. Also, replace the trusted_ip_address with the IP address(es) of the trusted sources that should be allowed HTTPS access.

Using Terraform

resource "aws_security_group" "WEB_SG" {
  name        = "WEB_SG_NAME"          # replace with your SG name
  description = "Security group for WEB_SG purpose"
  vpc_id      = "VPC_ID"               # replace with your VPC ID

  # Example: allow HTTPS only from trusted IPv4 range(s)
  ingress {
    description = "HTTPS from trusted IPv4 range"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [
      "TRUSTED_IPV4_CIDR_1",          # e.g. "203.0.113.0/24"
      # add more trusted ranges as needed
    ]
  }

  # Example: allow HTTPS only from trusted IPv6 range(s) (optional)
  # Omit this block entirely if you do not need IPv6 access.
  ingress {
    description      = "HTTPS from trusted IPv6 range"
    from_port        = 443
    to_port          = 443
    protocol         = "tcp"
    ipv6_cidr_blocks = [
      "TRUSTED_IPV6_CIDR_1",          # e.g. "2001:db8:1234::/64"
      # add more trusted ranges as needed
    ]
  }

  # Other, non-HTTPS rules can stay as required; just ensure there is
  # no rule with port 443 and cidr_blocks = ["0.0.0.0/0"] or
  # ipv6_cidr_blocks = ["::/0"].

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "WEB_SG_TAG_NAME"          # replace with desired tag
  }
}

This Terraform configuration removes any ingress rule that allows TCP port 443 from 0.0.0.0/0 or ::/0 and replaces it with rules restricted to trusted CIDR ranges, matching the effect of revoking those unrestricted rules via the AWS CLI. The change is in-place and does not replace the security group itself, but it may disrupt connectivity for clients outside the trusted ranges.To verify, terraform plan should show:

Removal of any existing ingress blocks with from_port = 443, to_port = 443, and cidr_blocks = ["0.0.0.0/0"] and/or ipv6_cidr_blocks = ["::/0"].
Addition (or update) of ingress blocks so that port 443 is only allowed from the specified trusted IPv4/IPv6 CIDR ranges.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted HTTPS Access Should Not Be Allowed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: