📝 AWS EC2 Security Group allows unrestricted ICMP traffic 🟢
- Contextual name: 📝 Security Group allows unrestricted ICMP traffic 🟢
- ID:
/ce/ca/aws/ec2/security-group-allows-unrestricted-icmp-traffic - Located in: 📁 AWS EC2
Flags
Our Metadata
- Policy Type:
COMPLIANCE_POLICY - Policy Category:
SECURITY
Similar Policies
- Cloud Conformity
- Internal
dec-x-42a09084
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-x-42a09084 | 1 |
Logic
- 🧠 prod.logic.yaml 🟢
Description
Description
Ensure that ICMP traffic (used for network diagnostics such as ping) is appropriately restricted in AWS EC2 Security Groups. Allowing unrestricted ICMP access can expose the EC2 instances to network reconnaissance or Denial of Service (DoS) attacks. Restricting ICMP access is essential for maintaining a secure environment by limiting unnecessary traffic and potential attack vectors.
Rational
ICMP is commonly used for network diagnostics but can also be exploited by malicious actors for reconnaissance purposes, such as identifying active hosts or determining the topology of your network. By allowing unrestricted ICMP access, attackers could send large numbers of requests (ping floods) that overwhelm systems or network devices, leading to a Denial of Service (DoS) attack. Restricting ICMP helps secure the infrastructure by minimizing exposure to such attacks while ensuring that legitimate diagnostic traffic remains functional.
Impact
You might impact network diagnostics or monitoring tools that rely on ICMP, requiring careful configuration of access.
... see more
Remediation
Remediation
From Command Line
- Run the following command to remove or modify the unrestricted rule for ICMP access:
aws ec2 revoke-security-group-ingress \
--region {{region-name}} \
--group-id {{security-group-id}} \
--protocol icmp \
--port {{-1}} \
--cidr {{0.0.0.0/0 or ::/0}}
Optionally, run the
authorise-security-group-ingresscommand to create a new rule, specifying a trusted CIDR range instead of0.0.0.0/0.
- Confirm the changes by describing the security group again and ensuring the unrestricted access rule has been removed or appropriately restricted:
aws ec2 describe-security-groups \
--region {{region-name}} \
--group-ids {{security-group-id}} \
--query 'SecurityGroups[*].IpPermissions[?IpProtocol==`icmp`].{CIDR:IpRanges[*].CidrIp,Port:FromPort}'
- After applying these changes, monitor the network for any issues related to legitimate use of ICMP, such as network diagnostics or monitoring tools, to ensure no unintended disruptions occur.