📝 AWS EC2 Security Group allows unrestricted traffic to Oracle DBMS 🟢
- Contextual name: 📝 Security Group allows unrestricted traffic to Oracle DBMS 🟢
- ID:
/ce/ca/aws/ec2/security-group-allows-unrestricted-traffic-to-oracle-dbms - Located in: 📁 AWS EC2
Flags
Our Metadata
- Policy Type:
COMPLIANCE_POLICY - Policy Category:
SECURITY
Similar Policies
- Cloud Conformity
- Internal
dec-z-c82c9f97
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-z-c82c9f97 | 1 |
Logic
- 🧠 prod.logic.yaml 🟢
Description
Description
Audit and modify AWS EC2 Security Groups to restrict inbound access to Oracle DBMS instances. Oracle DBMS typically runs on ports 1521, 1830, 2483 and 2484, and unrestricted access to these ports increases the risk of unauthorized access. Security Groups should be configured to allow traffic only from trusted IP addresses or internal systems to minimize exposure and safeguard sensitive data.
Rational
Allowing unrestricted access to Oracle DBMS increases the risk of unauthorized access, brute-force attacks, data theft, and exploitation of any vulnerabilities within Oracle. These databases are high-value targets for attackers, and exposing them to the public internet without proper controls can result in severe security incidents. By restricting access to trusted networks or IP ranges, you reduce the attack surface and improve the security posture of the Oracle database, helping to prevent unauthorized data access or modification.
Impact
Requires careful implementation to avoid disrupting legitimate connections or business processes that require access to the database.
... see more
Remediation
Remediation
From Command Line
- Run the following command to remove or modify the unrestricted rule for Oracle DBMS access:
aws ec2 revoke-security-group-ingress \
--region {{region-name}} \
--group-id {{security-group-id}} \
--protocol {{protocol}} \
--port {{1521}} \
--cidr {{0.0.0.0/0 or ::/0}}
Optionally, run the
authorise-security-group-ingresscommand to create a new rule, specifying a trusted CIDR range instead of0.0.0.0/0.
- Confirm the changes by describing the security group again and ensuring the unrestricted access rule has been removed or appropriately restricted:
aws ec2 describe-security-groups \
--region {{region-name}} \
--group-ids {{security-group-id}} \
--query 'SecurityGroups[*].IpPermissions[?FromPort==`1521`].{CIDR:IpRanges[*].CidrIp,Port:FromPort}'
- Monitor Oracle DBMS access to ensure it's unaffected by the changes.