Unrestricted Inbound Access on All Non-HTTP Ports Should Not Be Allowed
More Info:
No EC2 security group should allow unrestricted inbound access to any Non-HTTP Ports.Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, NIST, PCIDSS, AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of unrestricted inbound access on all Non-HTTP Ports in AWS, you can follow the below steps:
- Log in to your AWS console and navigate to the EC2 dashboard.
- Select the EC2 instance(s) for which you want to remediate the misconfiguration.
- Click on the “Security Groups” option under the “Description” tab.
- Identify the security group that is associated with the selected instance(s).
- Click on the “Inbound Rules” tab and identify the rule(s) that allow unrestricted inbound access on Non-HTTP Ports.
- Select the rule(s) and click on the “Edit” button.
- Change the “Source” field to limit the inbound access to specific IP addresses or CIDR blocks.
- Alternatively, you can also choose to restrict access to specific ports by changing the “Port Range” field.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration of unrestricted inbound access on all Non-HTTP Ports in AWS using AWS CLI, you can follow the below steps:This command will list all the security groups in your AWS account along with their details.Identify the security group that has unrestricted inbound access on all Non-HTTP Ports. You can identify it by checking the inbound rules of each security group.Step 2: Use the AWS CLI command to update the security group to restrict inbound access.Once you have identified the security group that has unrestricted inbound access on all Non-HTTP Ports, you can use the following AWS CLI command to update the security group to restrict inbound access:Replace This command will revoke the inbound rule that allows unrestricted access to port 22 for all IP addresses.Step 3: Verify that the security group is updated successfully.You can use the following AWS CLI command to describe the security group and verify that the inbound rule is revoked successfully:Replace
- Identify the security group that has unrestricted inbound access on all Non-HTTP Ports.
- Use the AWS CLI command to update the security group to restrict inbound access.
- Verify that the security group is updated successfully.
<security-group-id> with the ID of the security group that you want to update, <port-range> with the port range that you want to restrict, and <ip-address> with the IP address range that you want to restrict.For example, if you want to restrict inbound access to port 22 (SSH) for the security group with ID sg-0123456789abcdef0, you can use the following command:<security-group-id> with the ID of the security group that you updated.This command will describe the security group and show the inbound rules for the security group. Verify that the inbound rule that allows unrestricted access to the uncommon port is revoked successfully.Repeat the above steps for all the security groups that have unrestricted inbound access on Non-HTTP Ports.Using Python
Using Python
To remediate the misconfiguration of unrestricted inbound access on all Non-HTTP Ports in AWS using Python, you can follow the below steps:Step 1: Install the Boto3 library for Python using the following command:Step 2: Create an AWS session using the following code:Step 3: Get the list of all security groups in your AWS account using the following code:Step 4: Loop through all the security groups and check if they have any inbound rules with port numbers other than the common ports (e.g., 80, 443, 22, etc.). If any such rules are found, delete them using the following code:Step 5: Once all the security groups have been checked and updated, print a message indicating that the remediation process is complete:Overall, the above steps will help remediate the misconfiguration of unrestricted inbound access on all Non-HTTP Ports in AWS using Python.