1. Log in to the AWS Management Console.
2. Navigate to the EC2 service.
3. Select the EC2 instance(s) that have unrestricted SSH access.
4. Click on the “Actions” button and select “Networking” and then “Change Security Groups”.
5. In the “Change Security Groups” window, select the security group associated with the instance(s) and click “Edit”.
6. In the “Edit inbound rules” window, locate the SSH rule (port 22) and remove it or restrict it to only allow traffic from specific IP addresses or ranges.
7. Click “Save” to apply the changes.

​

1. Open the AWS CLI on your local machine.
2. Run the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

3. Identify the security group that allows unrestricted SSH access. You can look for a security group that has a rule allowing SSH traffic from 0.0.0.0/0 (any IP address) or ::/0 (any IPv6 address).
4. Once you have identified the security group, note down its Group ID.
5. Run the following command to revoke the SSH access rule from the security group:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 22 --cidr 0.0.0.0/0

6. Verify that the SSH access rule has been revoked by running the following command:

aws ec2 describe-security-groups --group-ids <security-group-id>

7. Repeat the above steps for all the security groups in your AWS account to ensure that SSH access is not allowed from any unauthorized IP addresses.

1. Import the necessary AWS SDKs and libraries in your Python script. You will need to import the boto3 library to interact with AWS services.

import boto3

2. Create a client session for EC2 using boto3.client().

ec2 = boto3.client('ec2')

3. Use the describe_security_groups() method to retrieve all the security groups in your AWS account.

security_groups = ec2.describe_security_groups()

4. Loop through each security group and check if it has any inbound rules allowing SSH access from any IP address (0.0.0.0/0).

for sg in security_groups['SecurityGroups']:
    for rule in sg['IpPermissions']:
        if rule['IpProtocol'] == 'tcp' and rule['FromPort'] <= 22 and rule['ToPort'] >= 22:
            for ip_range in rule['IpRanges']:
                if ip_range['CidrIp'] == '0.0.0.0/0':
                    print(f"Security group {sg['GroupId']} allows unrestricted SSH access.")

5. If any security group is found to have unrestricted SSH access, use the revoke_security_group_ingress() method to remove the rule allowing SSH access from any IP address.

ec2.revoke_security_group_ingress(
    GroupId=sg['GroupId'],
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 22,
            'ToPort': 22,
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0'
                }
            ]
        }
    ]
)

6. Run the Python script to remediate the unrestricted SSH access issue in your AWS account.

resource "aws_security_group" "ssh_restricted" {
  name        = "SSH_RESTRICTED_SG_NAME"      # replace with the security group name
  description = "Security group without unrestricted SSH"
  vpc_id      = "VPC_ID"                      # replace with your VPC ID

  # REMOVE any existing rule that allows:
  # - from_port = 22, to_port = 22, protocol = "tcp"
  #   with cidr_blocks = ["0.0.0.0/0"] or ipv6_cidr_blocks = ["::/0"]

  # Example: add a more restrictive SSH rule instead (optional)
  ingress {
    description = "SSH from trusted IPv4 address"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["TRUSTED_IPV4_CIDR"]       # e.g. "203.0.113.10/32"
  }

  # Example: no wide-open IPv6 SSH rule either; use a restricted prefix if needed
  # ingress {
  #   description      = "SSH from trusted IPv6 range"
  #   from_port        = 22
  #   to_port          = 22
  #   protocol         = "tcp"
  #   ipv6_cidr_blocks = ["TRUSTED_IPV6_CIDR"] # e.g. "2001:db8::/64"
  # }

  # other (non-SSH) ingress/egress rules as required
}

• any existing SSH ingress with from_port = 22, to_port = 22, protocol = "tcp" and cidr_blocks = ["0.0.0.0/0"] being destroyed,
• and, if you add them, new more-restrictive SSH rules being created.