Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of an EC2 instance having open ICMP ports in AWS Security Groups, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console.
- Navigate to the EC2 dashboard.
- In the navigation pane, choose “Security Groups.”
- Select the security group associated with the EC2 instance that has open ICMP ports.
- In the “Inbound rules” tab, locate the rule that allows ICMP traffic (Protocol: ICMP) with any source (0.0.0.0/0 or ::/0).
- Select the rule by checking the box next to it.
- Click on the “Actions” dropdown menu and choose “Edit inbound rules.”
- In the Edit inbound rules dialog box, locate the ICMP rule and click on the “X” icon to remove it.
- Click the “Save rules” button to apply the changes.
Using CLI
Using CLI
To remediate the open ICMP ports on an EC2 instance in AWS using AWS CLI, you can follow these steps:
-
Identify the Security Group associated with the EC2 instance that has the open ICMP ports:
Run the following AWS CLI command to describe the security groups associated with the EC2 instance:
Replace
<instance-id>with the actual ID of the EC2 instance. -
Identify the inbound rules in the Security Group that allow ICMP traffic:
Run the following AWS CLI command to describe the inbound rules of the Security Group:
Replace
<security-group-id>with the Security Group ID obtained in the previous step. -
Revoke the inbound rule that allows ICMP traffic:
Run the following AWS CLI command to revoke the inbound rule that allows ICMP traffic (replace the actual values for Protocol, Port Range, and CIDR IP based on the output from the previous step):
-
Verify that the inbound rule allowing ICMP traffic has been revoked:
Run the following AWS CLI command to describe the inbound rules of the Security Group again and verify that the rule allowing ICMP traffic is no longer present:
Using Python
Using Python
To remediate the misconfiguration of an EC2 instance having open ICMP ports in AWS Security Groups using Python, you can follow these steps:
- Install the Boto3 library using pip if you haven’t already:
- Use the following Python script to identify and revoke the ingress rule that allows ICMP traffic in the specified security group:
-
Replace
'YOUR_SECURITY_GROUP_ID'with the actual ID of the security group that needs to be remediated. - Run the Python script, and it will revoke any ingress rule that allows ICMP traffic in the specified security group.