Unrestricted Oracle Access Should Not Be Allowed

Using Console

To remediate the issue of unrestricted Oracle access in AWS, you can follow the below steps:

Open the AWS Management Console and navigate to the RDS service.
Select the affected RDS instance and click on the “Modify” button.
Scroll down to the “Network & Security” section and click on the “Additional Configuration” tab.
In the “Additional Configuration” tab, locate the “Publicly Accessible” option and set it to “No”.
Next, locate the “VPC Security Group” option and select the appropriate security group that allows access only to the required IP addresses or CIDR ranges.
Click on the “Continue” button and review the changes. If everything is correct, click on the “Modify DB Instance” button to apply the changes.
After the changes have been applied, verify that the RDS instance is no longer publicly accessible and that access is restricted to the required IP addresses or CIDR ranges.

By following these steps, you can remediate the issue of unrestricted Oracle access in AWS and ensure that your RDS instance is secure.

Using CLI

To remediate the unrestricted Oracle access issue in AWS, you can follow the below steps using AWS CLI:

Connect to your AWS account using AWS CLI.
Identify the security group that allows unrestricted Oracle access. You can use the following command to list all security groups in your AWS account:

aws ec2 describe-security-groups

Once you have identified the security group, use the following command to update the inbound rules of the security group to restrict access to Oracle:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 1521 --cidr 0.0.0.0/0

This command will remove the inbound rule that allows unrestricted access to Oracle on port 1521 from any IP address.

After running the above command, you can verify that the rule has been removed by running the following command:

aws ec2 describe-security-groups --group-ids <security-group-id>

This command will display the details of the security group, including the inbound rules.

Finally, you should test the Oracle access to ensure that it is restricted as expected. If necessary, you can modify the security group rules further to allow access only from specific IP addresses or networks.

Using Python

To remediate the “Unrestricted Oracle Access Should Not Be Allowed” misconfiguration in AWS using Python, you can follow these steps:

Install the Boto3 AWS SDK for Python:

!pip install boto3

Use Boto3 to connect to the AWS account:

import boto3

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY_ID',
    aws_secret_access_key='YOUR_SECRET_ACCESS_KEY',
    region_name='YOUR_REGION'
)

ec2 = session.client('ec2')

Use the describe_security_groups method to get a list of all the security groups in the account:

response = ec2.describe_security_groups()
security_groups = response['SecurityGroups']

Loop through the security groups and check if any of them have unrestricted Oracle access:

for sg in security_groups:
    for rule in sg['IpPermissions']:
        if rule['IpProtocol'] == 'tcp' and rule['FromPort'] == 1521 and rule['ToPort'] == 1521 and rule['IpRanges'] == [{'CidrIp': '0.0.0.0/0'}]:
            print(f"Security group {sg['GroupId']} has unrestricted Oracle access!")

If you find a security group with unrestricted Oracle access, use the revoke_security_group_ingress method to remove the rule:

ec2.revoke_security_group_ingress(
    GroupId=sg['GroupId'],
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 1521,
            'ToPort': 1521,
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        }
    ]
)

This will remove the unrestricted Oracle access from the security group.

Using Terraform

resource "aws_security_group" "oracle_db_sg" {
  name        = "oracle-db-sg"
  description = "Security group for Oracle DB without unrestricted access"
  vpc_id      = AWS_VPC_ID  # replace with your VPC ID
}

# Optional: keep a *restricted* IPv4 rule for Oracle (example: app subnet only)
resource "aws_vpc_security_group_ingress_rule" "oracle_db_ipv4_restricted" {
  security_group_id = aws_security_group.oracle_db_sg.id

  description = "Restricted Oracle access over IPv4"
  ip_protocol = "tcp"
  from_port   = 1521
  to_port     = 1521

  cidr_ipv4 = "ALLOWED_IPV4_CIDR"  # replace with a specific CIDR (e.g., app subnet), not 0.0.0.0/0
}

# Optional: keep a *restricted* IPv6 rule for Oracle
resource "aws_vpc_security_group_ingress_rule" "oracle_db_ipv6_restricted" {
  security_group_id = aws_security_group.oracle_db_sg.id

  description = "Restricted Oracle access over IPv6"
  ip_protocol = "tcp"
  from_port   = 1521
  to_port     = 1521

  cidr_ipv6 = "ALLOWED_IPV6_CIDR"  # replace with a specific IPv6 CIDR, not ::/0
}

Remove (or do not create) any aws_vpc_security_group_ingress_rule (or inline ingress blocks) that have:

ip_protocol = "tcp", from_port = 1521, to_port = 1521 AND cidr_ipv4 = "0.0.0.0/0"
ip_protocol = "tcp", from_port = 1521, to_port = 1521 AND cidr_ipv6 = "::/0"

This mirrors the CLI fix by revoking ingress from 0.0.0.0/0 and ::/0; it may break clients that currently use that open access but does not replace the security group itself.Verification: terraform plan should show the aws_vpc_security_group_ingress_rule resources (or inline ingress rules) for TCP/1521 with 0.0.0.0/0 and/or ::/0 being destroyed, and only restricted CIDRs (if any) remaining.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted Oracle Access Should Not Be Allowed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: