Ports Should Not Be Open for External Traffic

Using Console

To remediate the issue of ports being open for external traffic in AWS Security Groups, follow these steps using the AWS Management Console:

Sign in to the AWS Management Console.
Navigate to the EC2 dashboard.
In the navigation pane, under the ‘Network & Security’ section, click on ‘Security Groups’.
Select the security group that has the open ports for external traffic that you want to remediate.
Click on the ‘Inbound rules’ tab.
Identify the rule that allows external traffic (0.0.0.0/0) to access the specific port(s).
Click on the ‘Edit inbound rules’ button.
Select the rule that allows the unwanted external traffic and click on the ‘Delete’ button to remove it.
Click on the ‘Save rules’ button to apply the changes.
Verify that the rule allowing external traffic to the specific port(s) has been removed successfully.

By following these steps, you have successfully remediated the issue of ports being open for external traffic in the AWS Security Group.

Using CLI

To remediate the issue of ports being open for external traffic in AWS Security Groups using AWS CLI, follow these steps:

Identify the security group that has the open port for external traffic. You can use the following AWS CLI command to list all security groups in your AWS account:

aws ec2 describe-security-groups

Once you have identified the security group that needs to be remediated, note down the Group ID of the security group.
Use the following AWS CLI command to revoke the ingress rule that allows external traffic to the port in the security group. Replace <group-id> and <ip-permission-id> with the actual values:

aws ec2 revoke-security-group-ingress --group-id <group-id> --ip-permissions '[{"IpProtocol": "tcp", "FromPort": <port-number>, "ToPort": <port-number>, "IpRanges": [{"CidrIp": "0.0.0.0/0"}], "IpPermissionId": "<ip-permission-id>"}]'

Verify that the ingress rule has been revoked successfully by describing the security group again:

aws ec2 describe-security-groups --group-ids <group-id>

Repeat the above steps for any other security groups that have open ports for external traffic.

By following the above steps, you can successfully remediate the issue of ports being open for external traffic in AWS Security Groups using AWS CLI.

Using Python

To remediate the issue of ports being open for external traffic in AWS Security Groups using Python, you can use the AWS SDK for Python (Boto3) to update the security group rules. Here are the step-by-step instructions to remediate this issue:

Install the Boto3 library if you haven’t already:

pip install boto3

Use the following Python script to identify and close the open ports in the security groups:

import boto3

# Initialize the EC2 client
ec2 = boto3.client('ec2')

# Define the security group ID that you want to remediate
security_group_id = 'YOUR_SECURITY_GROUP_ID'

# Describe the current inbound rules of the security group
response = ec2.describe_security_groups(GroupIds=[security_group_id])

# Iterate over each inbound rule and revoke the open ports
for rule in response['SecurityGroups'][0]['IpPermissions']:
    if 'FromPort' in rule and 'ToPort' in rule:
        from_port = rule['FromPort']
        to_port = rule['ToPort']
        if from_port != to_port:
            ec2.revoke_security_group_ingress(
                GroupId=security_group_id,
                IpPermissions=[{
                    'FromPort': from_port,
                    'ToPort': to_port,
                    'IpProtocol': rule['IpProtocol'],
                    'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
                }]
            )
        else:
            ec2.revoke_security_group_ingress(
                GroupId=security_group_id,
                IpPermissions=[{
                    'FromPort': from_port,
                    'ToPort': to_port,
                    'IpProtocol': rule['IpProtocol'],
                    'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
                }]
            )

print("Security group remediated successfully.")

Replace 'YOUR_SECURITY_GROUP_ID' with the actual ID of the security group that you want to remediate.
Run the Python script. It will iterate over each inbound rule in the specified security group and revoke the open ports for external traffic.

By following these steps, you can remediate the issue of open ports for external traffic in AWS Security Groups using Python and the Boto3 library.

Using Terraform

# Security group attached to the EC2 instance; keep this, but do NOT define
# any rule that has protocol = "-1" with 0.0.0.0/0 or ::/0.
resource "aws_security_group" "SERVICE_SG" {
  name        = "SERVICE_SG"
  description = "Security group for SERVICE_NAME"
  vpc_id      = aws_vpc.VPC_ID.id  # substitute your VPC resource

  tags = {
    Name = "SERVICE_SG"
  }
}

# Example of a *restricted* ingress rule for a specific service (e.g., HTTPS from a private CIDR),
# instead of "all traffic" from the entire internet.
resource "aws_vpc_security_group_ingress_rule" "service_https_from_private" {
  security_group_id = aws_security_group.SERVICE_SG.id

  ip_protocol = "tcp"
  from_port   = 443
  to_port     = 443

  cidr_ipv4 = "10.0.0.0/16"  # substitute with your allowed IPv4 CIDR
}

# If you previously had rules like the following, REMOVE those Terraform resources entirely:
# (they are the Terraform equivalent of the aws ec2 revoke-security-group-ingress commands)
#
# resource "aws_vpc_security_group_ingress_rule" "all_traffic_ipv4" {
#   security_group_id = aws_security_group.SERVICE_SG.id
#   ip_protocol       = "-1"
#   cidr_ipv4         = "0.0.0.0/0"
# }
#
# resource "aws_vpc_security_group_ingress_rule" "all_traffic_ipv6" {
#   security_group_id = aws_security_group.SERVICE_SG.id
#   ip_protocol       = "-1"
#   cidr_ipv6         = "::/0"
# }

Removing the aws_vpc_security_group_ingress_rule resources that model ip_protocol = "-1" with cidr_ipv4 = "0.0.0.0/0" or cidr_ipv6 = "::/0" is a permanent change and can break traffic if those rules are currently used; ensure you have more specific rules in place first.On terraform plan, you should see the offending aws_vpc_security_group_ingress_rule resources scheduled for - destroy and any new, restricted ingress rules (like the HTTPS example) scheduled for + create.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Ports Should Not Be Open for External Traffic

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: