📝 AWS EC2 Security Group allows unrestricted traffic to all ports 🟢

• Contextual name: 📝 Security Group allows unrestricted traffic to all ports 🟢
• ID: /ce/ca/aws/ec2/security-group-allows-unrestricted-traffic-to-all-ports
• Located in: 📁 AWS EC2

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Internal
  • dec-x-3e95721c

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-3e95721c	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS EC2 Security Group
  • 🔌 AWS EC2 Security Group Rule - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Audit and restrict AWS EC2 Security Group configurations to prevent unrestricted traffic across all ports. Security Groups allowing inbound traffic to all ports (0-65535) from unrestricted IP ranges (e.g., 0.0.0.0/0) pose a critical security risk and should be modified to permit access only to specific ports and trusted IP ranges as per application requirements.

Rational

Allowing unrestricted traffic to all ports exposes instances to a broad range of potential threats, including unauthorized access, malware attacks, data exfiltration,, and exploitation of known and unknown vulnerabilities. Such configurations significantly increase the attack surface of your infrastructure, making it easier for malicious actors to compromise systems. Restricting access to specific ports and trusted IP ranges minimizes the exposure, and reduces the risk of data breaches and unauthorized activities.

Impact

Requires careful planning to avoid disrupting legitimate traffic or business operations.

Audit

This policy marks an EC2 Security Group as INCOMPLIANT if it contains a rule that meets all the following conditions:

... see more

Remediation

Open File

Remediation

From Command Line

1. Run the following command to remove or modify the unrestricted rule:

aws ec2 revoke-security-group-ingress \
--region {{region-name}} \
--group-id {{security-group-id}} \
--protocol {{protocol}} \
--port {{0-65535}} \
--cidr {{0.0.0.0/0 or ::/0}}

• Optionally, run the authorise-security-group-ingress command to create a new rule, specifying a trusted CIDR range instead of 0.0.0.0/0.

2. Confirm the changes by describing the security group again and ensuring the unrestricted access rule has been removed or appropriately restricted:

aws ec2 describe-security-groups \
--region {{region-name}} \
--group-ids {{security-group-id}} \
--query 'SecurityGroups[*].IpPermissions[?FromPort==`22`].{CIDR:IpRanges[*].CidrIp,Port:FromPort}'

3. Conduct tests to verify functionality of applications to ensure they are unaffected by the changes.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 Cloudaware Framework → 💼 Threat Protection			25
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet		33	36