Unrestricted RPC Access Should Not Be Allowed

Using Console

To remediate the issue of unrestricted RPC access in AWS, you can follow these steps:

Open the AWS Management Console and go to the EC2 dashboard.
Click on the “Security Groups” option in the left-hand menu.
Select the security group that is allowing unrestricted RPC access.
Click on the “Inbound Rules” tab and locate the rule that allows RPC access.
Click on the “Edit” button next to the rule.
Change the source IP address to a specific IP address or range of IP addresses that require access to RPC.
If necessary, add a new rule to allow access to RPC from specific IP addresses or ranges.
Click on the “Save” button to apply the changes.

Once the changes are saved, the security group will no longer allow unrestricted RPC access. It is important to regularly review and update security group rules to ensure that they are properly configured and do not leave any vulnerabilities open to attack.

Using CLI

To remediate the “Unrestricted RPC Access Should Not Be Allowed” misconfiguration in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine.
Run the following command to list the security groups in your AWS account:
aws ec2 describe-security-groups
Identify the security group that has the unrestricted RPC access.
Run the following command to modify the security group and remove the unrestricted RPC access:
aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 111 --cidr 0.0.0.0/0
Note: Replace <security-group-id> with the ID of the security group that has the unrestricted RPC access.
Run the following command to verify that the unrestricted RPC access has been removed:
aws ec2 describe-security-groups --group-ids <security-group-id>
Note: Replace <security-group-id> with the ID of the security group that has the unrestricted RPC access.
Verify that the remediation was successful by confirming that the security group no longer has unrestricted RPC access.

By following these steps, you can remediate the “Unrestricted RPC Access Should Not Be Allowed” misconfiguration in AWS using AWS CLI.

Using Python

To remediate the “Unrestricted RPC Access Should Not Be Allowed” issue in AWS using Python, follow the below steps:

First, we need to identify the security group that allows unrestricted RPC access. You can use the following Python code to list all the security groups in your AWS account:

import boto3

ec2 = boto3.client('ec2')

response = ec2.describe_security_groups()
for sg in response['SecurityGroups']:
    print(sg['GroupId'], sg['GroupName'])

Once you have identified the security group that allows unrestricted RPC access, you can use the following Python code to revoke the rule:

import boto3

ec2 = boto3.client('ec2')

response = ec2.revoke_security_group_ingress(
    GroupId='SECURITY_GROUP_ID',
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 135,
            'ToPort': 139,
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        },
        {
            'IpProtocol': 'tcp',
            'FromPort': 445,
            'ToPort': 445,
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        },
        {
            'IpProtocol': 'udp',
            'FromPort': 137,
            'ToPort': 138,
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        }
    ]
)

In the above code, replace ‘SECURITY_GROUP_ID’ with the ID of the security group that allows unrestricted RPC access.

The above code will revoke the rule that allows unrestricted RPC access. You can run the first code again to verify that the rule has been revoked.

Note: The above code assumes that you have the necessary permissions to modify security groups in your AWS account.

Using Terraform

resource "aws_security_group" "RPC_SG" {
  name        = "rpc-sg"
  description = "Example SG without unrestricted RPC (TCP 135) access"
  vpc_id      = AWS_VPC_ID  # replace with your VPC ID

  # REMOVE any ingress blocks that:
  # - use protocol "tcp"
  # - have from_port = 135 and to_port = 135
  # - and allow cidr_blocks = ["0.0.0.0/0"] or ipv6_cidr_blocks = ["::/0"]

  # Example of a more restricted rule (only if truly needed):
  # ingress {
  #   description = "RPC from a limited CIDR range"
  #   from_port   = 135
  #   to_port     = 135
  #   protocol    = "tcp"
  #   cidr_blocks = ["ALLOWED_IPV4_CIDR"]  # replace with a specific CIDR, e.g. "10.0.0.0/16"
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "RPC SG without unrestricted TCP 135"
  }
}

If you manage rules with standalone resources (recommended with current AWS provider), delete the offending resources instead of changing the security group itself:

# DELETE any resources like this that allow 0.0.0.0/0 on TCP 135
resource "aws_vpc_security_group_ingress_rule" "UNRESTRICTED_RPC_IPV4" {
  security_group_id = AWS_SECURITY_GROUP_ID   # replace with your SG ID
  from_port         = 135
  to_port           = 135
  ip_protocol       = "tcp"
  cidr_ipv4         = "0.0.0.0/0"
}

# DELETE any resources like this that allow ::/0 on TCP 135
resource "aws_vpc_security_group_ingress_rule" "UNRESTRICTED_RPC_IPV6" {
  security_group_id = AWS_SECURITY_GROUP_ID   # replace with your SG ID
  from_port         = 135
  to_port           = 135
  ip_protocol       = "tcp"
  cidr_ipv6         = "::/0"
}

This change removes the specific rules allowing unrestricted inbound TCP 135; it does not force replacement of the security group itself, only the individual ingress rules. Be aware this may break any workloads that rely on open RPC from the internet.For verification, terraform plan should show the offending ingress rule resources being destroyed (- aws_vpc_security_group_ingress_rule.UNRESTRICTED_RPC_IPV4 / UNRESTRICTED_RPC_IPV6) or the corresponding inline ingress blocks being removed from the security group.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted RPC Access Should Not Be Allowed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: