Unrestricted mssql access remediation

Using Console

Using CLI

Using Python

To remediate this misconfiguration in AWS using Python, you can follow the below steps:

Identify the security group associated with the MS SQL Server instance.
Get the IP address of the client machine from where the MS SQL Server connection is initiated.
Create a new security group rule that allows incoming traffic from the client machine IP address to the MS SQL Server instance on port 1433.
Remove the existing security group rule that allows unrestricted access to the MS SQL Server instance.

Here’s the Python code to remediate this misconfiguration:

import boto3

# Specify the region where the MS SQL Server instance is located
region_name = 'us-west-2'

# Specify the name of the security group associated with the MS SQL Server instance
security_group_name = 'ms-sql-sg'

# Specify the IP address of the client machine from where the MS SQL Server connection is initiated
client_ip_address = '10.0.0.1/32'

# Create a new security group rule that allows incoming traffic from the client machine IP address to the MS SQL Server instance on port 1433
ec2 = boto3.client('ec2', region_name=region_name)
response = ec2.authorize_security_group_ingress(
    GroupName=security_group_name,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 1433,
            'ToPort': 1433,
            'IpRanges': [
                {
                    'CidrIp': client_ip_address,
                    'Description': 'Allow MS SQL Server access from client IP address'
                },
            ],
        },
    ],
)

# Remove the existing security group rule that allows unrestricted access to the MS SQL Server instance
response = ec2.revoke_security_group_ingress(
    GroupName=security_group_name,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 1433,
            'ToPort': 1433,
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0',
                },
            ],
        },
    ],
)

Note: Replace the region_name, security_group_name, and client_ip_address variables with the appropriate values for your environment.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted mssql access remediation

Triage and Remediation

Remediation