More Info:

No security group should allow unrestricted inbound access to TCP port 443 (HTTPS).

Risk Level

Low

Address

Security

Compliance Standards

AWSWAF, SOC2, GDPR

Triage and Remediation

Remediation

To remediate the “Unrestricted HTTPS Access Should Not Be Allowed” misconfiguration in AWS, you can follow these steps:

  1. Log in to the AWS Management Console.
  2. Navigate to the AWS EC2 service.
  3. Click on the “Security Groups” option from the left-hand menu.
  4. Select the security group that is associated with the instance(s) that have unrestricted HTTPS access.
  5. Click on the “Inbound Rules” tab.
  6. Locate the HTTPS rule that has unrestricted access (i.e., source is set to “0.0.0.0/0” or ”::/0”).
  7. Click on the “Edit” button for the rule.
  8. Change the source to a more restrictive IP range or security group that requires HTTPS access.
  9. Click on the “Save Rules” button to apply the changes.

Note: If you are unsure which security group is associated with the instance(s) that have unrestricted HTTPS access, you can view the instance details to find the security group ID and then navigate to the Security Groups section to find the security group.

Additional Reading: