Skip to main content

🛡️ AWS EC2 Security Group auto-provisioning status🟢

Stats​

not available

Logic​

Description​

Open File

Description​

Identify AWS EC2 Security Groups that appear to be associated with AWS-managed provisioning or management workflows.

This policy checks for AWS-managed tag signals that can help identify an EC2 security group as associated with AWS CloudFormation, Amazon EKS, AWS Service Catalog, AWS Application Migration Service, AWS Elastic Disaster Recovery, or AWS Elastic Beanstalk.

Rationale​

AWS-managed tags can provide evidence that an EC2 security group was created by, attached to, or managed through an AWS service workflow. This allows to distinguish security groups with supported AWS-managed provisioning indicators from security groups that are not identified by this tag-based method.

Audit​

This policy classifies an AWS EC2 Security Group as identified by automated provisioning evidence when the security group has one of the following supported tag signals:

  • One of the AWS CloudFormation stack-level tags:
    • aws:cloudformation:logical-id
    • aws:cloudformation:stack-id
    • aws:cloudformation:stack-name

... see more

Remediation​

Open File

Review​

Review the EC2 security group and confirm how it was created and managed.

Validate whether the security group is associated with a CloudFormation stack, Amazon EKS cluster, Service Catalog provisioned product, AWS Application Migration Service workflow, AWS Elastic Disaster Recovery workflow, Elastic Beanstalk environment, another automation workflow, or a manual process. If the creation source is known, document the ownership and lifecycle expectations. If the security group is no longer needed, remove it through the appropriate operational process.

policy.yaml​

Open File