Unrestricted ICMP Access Should Not Be Allowed

Using Console

To remediate the “Unrestricted ICMP Access Should Not Be Allowed” misconfiguration in AWS using the AWS console, you can follow the below steps:

Log in to the AWS Management Console and navigate to the EC2 Dashboard.
Click on the “Security Groups” option from the left-hand menu.
Select the security group that has unrestricted ICMP access.
Click on the “Inbound Rules” tab.
Locate the rule that allows all ICMP traffic (Protocol: ICMP, Port Range: All).
Click on the “Edit” button for that rule.
Change the “Source” field to a specific IP range or security group that requires access to ICMP traffic. If you want to allow ICMP traffic from any IP address, you can select “My IP” option.
Click on the “Save” button to apply the changes.

Once the above steps are completed, the ICMP traffic will be restricted to the specified IP range or security group.

Using CLI

To remediate the unrestricted ICMP access issue in AWS using AWS CLI, follow these steps:

Open the AWS CLI or AWS Management Console.
Identify the security group that has unrestricted ICMP access. You can use the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

Once you have identified the security group, use the following command to revoke the ICMP access rule:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol icmp

Replace <security-group-id> with the ID of the security group that has unrestricted ICMP access.

Verify that the ICMP access rule has been revoked by running the following command:

aws ec2 describe-security-groups --group-ids <security-group-id>

This should return the details of the security group, which should no longer have the ICMP access rule.

Repeat the above steps for all the security groups that have unrestricted ICMP access.

By following these steps, you can remediate the unrestricted ICMP access issue in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of unrestricted ICMP access in AWS using Python, you can follow these steps:

Identify the security group(s) that allow unrestricted ICMP access.
Use the AWS SDK for Python (Boto3) to modify the security group(s) and remove the rule that allows unrestricted ICMP access.

Here’s an example Python code snippet that you can use to remediate the misconfiguration:

import boto3

# Initialize the Boto3 client
ec2 = boto3.client('ec2')

# Define the security group ID(s) that allow unrestricted ICMP access
security_group_ids = ['sg-0123456789abcdefg', 'sg-abcdef0123456789']

# Loop through the security group IDs and remove the rule that allows unrestricted ICMP access
for sg_id in security_group_ids:
    # Describe the security group
    response = ec2.describe_security_groups(GroupIds=[sg_id])
    security_group = response['SecurityGroups'][0]

    # Loop through the inbound rules and remove the rule that allows unrestricted ICMP access
    for rule in security_group['IpPermissions']:
        if rule['IpProtocol'] == 'icmp' and rule['IpRanges'] == [{'CidrIp': '0.0.0.0/0'}]:
            ec2.revoke_security_group_ingress(
                GroupId=sg_id,
                IpPermissions=[{
                    'IpProtocol': 'icmp',
                    'IpRanges': [{'CidrIp': '0.0.0.0/0'}],
                    'UserIdGroupPairs': [],
                    'PrefixListIds': [],
                    'Ipv6Ranges': []
                }]
            )

Note: Replace the security_group_ids with the actual security group IDs that allow unrestricted ICMP access.

Using Terraform

# Security group definition (example – adjust NAME, VPC, and TAGS)
resource "aws_security_group" "example" {
  name        = "EXISTING_SG_NAME"       # replace with your SG name
  description = "EXISTING_SG_DESCRIPTION" # replace with your SG description
  vpc_id      = aws_vpc.EXISTING_VPC.id   # replace with your VPC reference

  tags = {
    Name = "EXISTING_SG_TAG_NAME"         # replace with your tag(s)
  }
}

# BEFORE (violating rule – REMOVE this resource):
# resource "aws_vpc_security_group_ingress_rule" "icmp_all_ipv4" {
#   security_group_id = aws_security_group.example.id
#   cidr_ipv4         = "0.0.0.0/0"
#   ip_protocol       = "icmp"
#   from_port         = -1
#   to_port           = -1
# }

# resource "aws_vpc_security_group_ingress_rule" "icmp_all_ipv6" {
#   security_group_id = aws_security_group.example.id
#   cidr_ipv6         = "::/0"
#   ip_protocol       = "icmpv6"
#   from_port         = -1
#   to_port           = -1
# }

# AFTER (compliant: the unrestricted ICMP/ICMPv6 ingress rules are simply not present)

# Example of a more restricted ICMP rule, if you still need some ICMP:
# (optional – include only if a specific, limited ICMP use case is required)
resource "aws_vpc_security_group_ingress_rule" "icmp_limited_ipv4" {
  security_group_id = aws_security_group.example.id
  cidr_ipv4         = "ALLOWED_IPV4_CIDR" # e.g. "203.0.113.0/24" – replace with your allowed source
  ip_protocol       = "icmp"
  from_port         = 8                   # example: echo request
  to_port           = -1
}

resource "aws_vpc_security_group_ingress_rule" "icmp_limited_ipv6" {
  security_group_id = aws_security_group.example.id
  cidr_ipv6         = "ALLOWED_IPV6_CIDR" # e.g. "2001:db8::/48" – replace with your allowed source
  ip_protocol       = "icmpv6"
  from_port         = 128                 # example ICMPv6 type; adjust as needed
  to_port           = -1
}

Removing the aws_vpc_security_group_ingress_rule resources that model icmp from 0.0.0.0/0 and icmpv6 from ::/0 is a destructive change for those rules only: Terraform will delete the offending ingress rules but will not replace the security group itself.To verify, run terraform plan and confirm it shows - (destroy) for the unrestricted aws_vpc_security_group_ingress_rule resources and no remaining ingress rule with ip_protocol = "icmp"/"icmpv6" and cidr_ipv4 = "0.0.0.0/0" or cidr_ipv6 = "::/0".

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted ICMP Access Should Not Be Allowed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: