Unrestricted RPC Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP port 135 (RPC).Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, GDPR, HITRUST, AWSWAF, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of unrestricted RPC access in AWS, you can follow these steps:
- Open the AWS Management Console and go to the EC2 dashboard.
- Click on the “Security Groups” option in the left-hand menu.
- Select the security group that is allowing unrestricted RPC access.
- Click on the “Inbound Rules” tab and locate the rule that allows RPC access.
- Click on the “Edit” button next to the rule.
- Change the source IP address to a specific IP address or range of IP addresses that require access to RPC.
- If necessary, add a new rule to allow access to RPC from specific IP addresses or ranges.
- Click on the “Save” button to apply the changes.
Using CLI
Using CLI
To remediate the “Unrestricted RPC Access Should Not Be Allowed” misconfiguration in AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine.
-
Run the following command to list the security groups in your AWS account:
- Identify the security group that has the unrestricted RPC access.
-
Run the following command to modify the security group and remove the unrestricted RPC access:
Note: Replace
<security-group-id>with the ID of the security group that has the unrestricted RPC access. -
Run the following command to verify that the unrestricted RPC access has been removed:
Note: Replace
<security-group-id>with the ID of the security group that has the unrestricted RPC access. - Verify that the remediation was successful by confirming that the security group no longer has unrestricted RPC access.
Using Python
Using Python
To remediate the “Unrestricted RPC Access Should Not Be Allowed” issue in AWS using Python, follow the below steps:In the above code, replace ‘SECURITY_GROUP_ID’ with the ID of the security group that allows unrestricted RPC access.
- First, we need to identify the security group that allows unrestricted RPC access. You can use the following Python code to list all the security groups in your AWS account:
- Once you have identified the security group that allows unrestricted RPC access, you can use the following Python code to revoke the rule:
- The above code will revoke the rule that allows unrestricted RPC access. You can run the first code again to verify that the rule has been revoked.