Unrestricted PostgreSQL Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP port 5432 (PostgreSQL Database).Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, GDPR, HITRUST, AWSWAF, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the unrestricted PostgreSQL access issue in AWS, you can follow the below steps:
- Go to the AWS Management Console and navigate to the RDS dashboard.
- Select the RDS instance that has unrestricted PostgreSQL access.
- Click on the “Modify” button.
- In the “Network & Security” section, select the “Additional Configuration” tab.
- Under “Security Group Rules,” locate the rule that allows unrestricted PostgreSQL access.
- Remove the rule by clicking on the “x” icon next to it.
- Add a new rule that allows access only from trusted sources.
- Click on the “Save Changes” button.
Using CLI
Using CLI
To remediate unrestricted PostgreSQL access in AWS, you can follow these steps using AWS CLI:
-
Open the AWS CLI and run the following command to get the security group ID of the security group associated with the PostgreSQL instance:
-
Run the following command to get the ID of the security group:
-
Run the following command to revoke the unrestricted access to PostgreSQL:
This command will revoke the inbound rule that allows unrestricted access to PostgreSQL.
-
Run the following command to verify that the unrestricted access has been revoked:
This command will show the current inbound rules for the security group. You should see that the rule allowing unrestricted access to PostgreSQL has been removed.
Using Python
Using Python
To remediate the unrestricted PostgreSQL access issue in AWS, you can use Python to create a security group that allows access to the PostgreSQL instance only from a specific IP address or range of IP addresses. Here are the steps to do so:This code will print the security group rules associated with each security group, which should show that access to the PostgreSQL port (5432) is only allowed from the specific IP address or range of IP addresses that you specified in the security group rule.
- First, you need to create a new security group that will be used to restrict access to the PostgreSQL instance. You can do this using the
boto3library in Python. Here’s an example code snippet that creates a new security group:
- Once you’ve created the new security group, you need to assign it to the PostgreSQL instance. You can do this using the
modify_db_instancemethod from theboto3library. Here’s an example code snippet that assigns the new security group to the PostgreSQL instance:
- Finally, you can verify that the access to the PostgreSQL instance has been restricted by checking the security group rules associated with the instance. You can do this using the
describe_db_instancesmethod from theboto3library. Here’s an example code snippet that checks the security group rules: