Triage and Remediation
Remediation
Using Console
Using Console
To remediate the unrestricted RDP access issue in AWS, you can follow these steps:
- Login to the AWS Management Console.
- Navigate to the EC2 service.
- Select the EC2 instance(s) for which you want to restrict RDP access.
- Click on the “Security Groups” tab in the bottom pane.
- Select the security group(s) associated with the instance(s).
- Click on the “Inbound Rules” tab.
- Locate the rule that allows RDP access from any IP address (0.0.0.0/0).
- Click on the “Edit” button next to the rule.
- Change the source IP address to a specific IP address or range of IP addresses that are allowed to access RDP.
- Click on the “Save” button to apply the changes.
- Repeat these steps for all instances that have unrestricted RDP access.
Using CLI
Using CLI
To remediate the unrestricted RDP access in AWS, you can follow the below steps using AWS CLI:Note: Replace Note: Replace
- Open the AWS CLI on your local machine.
- Run the below command to list all the security groups in your AWS account.
- Identify the security group that allows unrestricted RDP access.
- Run the below command to revoke the inbound rule that allows unrestricted RDP access.
<security-group-id> with the ID of the security group identified in step 3.- Verify that the inbound rule has been revoked by running the below command.
<security-group-id> with the ID of the security group identified in step 3.- Repeat steps 3 to 5 for all the security groups that allow unrestricted RDP access.
Using Python
Using Python
To remediate unrestricted RDP access in AWS using Python, you can follow these steps:
- Import the necessary AWS SDK libraries in your Python script. You can use the Boto3 library to interact with AWS services.
- Initialize the EC2 client using the Boto3 library.
- Use the
describe_security_groupsmethod to get a list of all security groups in your AWS account.
- Loop through the security groups and check if any of them have an inbound rule allowing unrestricted RDP access (port 3389).
- Save the Python script and run it to remove the rule that allows unrestricted RDP access in all security groups in your AWS account.