Rule: VPC Default Security Group Restrictions
This rule ensures VPC default security group restricts all traffic for improved security measures.
| Rule | VPC default security group should not allow inbound and outbound traffic |
| Framework | FedRAMP Low Revision 4 |
| Severity | ✔ Medium |
Rule Description:
The default security group in an Amazon Virtual Private Cloud (VPC) should not allow inbound or outbound traffic for the FedRAMP Low Revision 4 compliance. This rule ensures that the default security group is properly configured to restrict network traffic, aligning with the security requirements of the FedRAMP Low standard.
Troubleshooting:
If the default security group allows inbound or outbound traffic for the FedRAMP Low Revision 4 compliance, users may encounter security vulnerabilities and fail to meet the required regulatory standards. Troubleshooting steps include:
- 1.Identify the security group associated with the VPC.
- 2.Review the inbound and outbound rules allowed for the default security group.
- 3.Check if there are any rules allowing traffic that violates the FedRAMP Low Revision 4 compliance.
- 4.Modify the security group rules to restrict the traffic as per the compliance requirements.
Code:
No specific code is provided as this rule involves configuration changes in the AWS Management Console or CLI commands.
Remediation:
Follow the step-by-step guide to remediate the rule and meet the compliance requirements:
Step 1: Access the AWS Management Console
- 1.Navigate to the AWS Management Console using the provided login credentials.
Step 2: Locate the Default Security Group
- 1.In the AWS Management Console, go to the VPC service.
- 2.Select "Security Groups" from the sidebar menu.
- 3.Locate the default security group associated with the VPC.
Step 3: Review Inbound Rules
- 1.Click on the default security group.
- 2.Switch to the "Inbound Rules" tab.
- 3.Review the existing inbound rules and note any rules allowing traffic that violates the FedRAMP Low Revision 4 compliance.
Step 4: Remove Violating Inbound Rules
- 1.Identify the violating inbound rules and note their configurations.
- 2.Select each rule and click on "Delete" or "Remove" to remove them.
- 3.Repeat this step for all violating inbound rules.
Step 5: Review Outbound Rules
- 1.Switch to the "Outbound Rules" tab in the default security group settings.
- 2.Review the existing outbound rules and note any rules allowing traffic that violates the FedRAMP Low Revision 4 compliance.
Step 6: Remove Violating Outbound Rules
- 1.Identify the violating outbound rules and note their configurations.
- 2.Select each rule and click on "Delete" or "Remove" to remove them.
- 3.Repeat this step for all violating outbound rules.
Step 7: Save Changes
- 1.Click on "Save" or "Apply Changes" to save the modifications made to the default security group.
Conclusion:
By following the provided steps, you have successfully reviewed and remediated the default security group in the VPC to disallow inbound and outbound traffic that violates the FedRAMP Low Revision 4 compliance. This ensures that the default security group aligns with the necessary security measures required for the FedRAMP Low standard.