Ensure the Default Security Group Restricts All Traffic Rule

Rule Description: Restrict all traffic in the default security group of every VPC to comply with CIS Amazon Web Services Foundations Benchmark (Version 1.5.0).

Description:

Troubleshooting:

2. 1.
   Verify that the default security group is associated with the affected VPC.
4. 2.
   Check the inbound and outbound rules of the default security group to ensure that they comply with the CIS benchmark's requirement of restricting all traffic.
6. 3.
   Confirm that the appropriate protocols, ports, and IP ranges are allowed, if required.
8. 4.
   If necessary, update the default security group rules to allow specific inbound and outbound traffic that is required for the instances in the VPC.

Code:

Using AWS CLI:

2. 1.
   Open a terminal or command prompt.
4. 2.
   Ensure you have the AWS CLI installed and configured with the necessary credentials.
6. 3.
   Run the following command to modify the default security group's inbound rules to deny all traffic:

aws ec2 revoke-security-group-ingress --group-id <default-security-group-id> --protocol all --port all --source-security-group <default-security-group-id>

2. 1.
   Run the following command to modify the default security group's outbound rules to deny all traffic:

aws ec2 revoke-security-group-egress --group-id <default-security-group-id> --protocol all --port all --destination-security-group <default-security-group-id>

2. 1.
   Verify that the rules have been updated by running the following command:

aws ec2 describe-security-groups --group-ids <default-security-group-id>

Using AWS Management Console:

2. 1.
   Open the AWS Management Console and navigate to the EC2 service.
4. 2.
   Click on "Security Groups" in the left navigation pane.
6. 3.
   Find the default security group associated with the desired VPC.
8. 4.
   Select the default security group and click on the "Inbound Rules" tab.
10. 5.
    Edit the inbound rules by removing all existing rules or modifying them to deny all traffic.
12. 6.
    Click on the "Outbound Rules" tab.
14. 7.
    Edit the outbound rules by removing all existing rules or modifying them to deny all traffic.
16. 8.
    Save the changes and verify that the rules have been updated.

Remediation Steps:

2. 1.
   Identify the VPC(s) with non-compliant default security group(s).
4. 2.
   Access the AWS Management Console or the AWS CLI.
6. 3.
   Navigate to the EC2 service.
8. 4.
   Select the default security group associated with the non-compliant VPC.
10. 5.
    Update the inbound rules to deny all traffic.
12. 6.
    Update the outbound rules to deny all traffic.
14. 7.
    Save the changes.
16. 8.
    Verify that the default security group now restricts all traffic by reviewing its rules.
18. 9.
    Repeat the remediation steps for any other non-compliant default security groups in other VPCs.