Rule: VPC Default Security Group Restrictions
This rule ensures VPC default security group does not allow inbound and outbound traffic.
| Rule | VPC default security group should not allow inbound and outbound traffic |
| Framework | FedRAMP Moderate Revision 4 |
| Severity | ✔ Medium |
Rule Description:
The VPC default security group should not allow inbound and outbound traffic for FedRAMP Moderate Revision 4. This rule is enforced to ensure compliance with the security requirements defined in the FedRAMP Moderate Revision 4 framework.
Troubleshooting Steps:
If the VPC default security group allows inbound and outbound traffic for FedRAMP Moderate Revision 4, you can follow these troubleshooting steps to rectify the issue:
- 1.
Verify Default Security Group Settings: Check the inbound and outbound rules of the default security group associated with the VPC. Ensure that there are no rules allowing any traffic for FedRAMP Moderate Revision 4.
- 2.
Review Rule Priority: If there are existing rules allowing inbound or outbound traffic for FedRAMP Moderate Revision 4, check the rule priorities. Lower priority rules may override the desired security settings. Adjust the rule priorities accordingly to ensure the desired restriction is in place.
- 3.
Rules Evaluation Order: Evaluate the order in which the rules are evaluated by the security group. Rules are matched from top to bottom based on the priority. Ensure that any rules allowing traffic for FedRAMP Moderate Revision 4 are placed at the bottom of the rule list.
Necessary Codes:
No specific codes are required for this rule as it involves configuring and managing the security group rules through the AWS Management Console or CLI.
Step-by-step Guide for Remediation:
- 1.
Log in to the AWS Management Console (or open the AWS CLI) and navigate to the Amazon VPC service.
- 2.
Go to the "Security Groups" section.
- 3.
Identify the default security group associated with the VPC you want to modify.
- 4.
Click on the default security group to view its details and existing inbound/outbound rules.
- 5.
Review the existing rules and check if there are any rules allowing inbound or outbound traffic for FedRAMP Moderate Revision 4.
- 6.
If such rules exist, select the rule and click on "Delete" or use the CLI command
to remove the inbound rule oraws ec2 revoke-security-group-ingress
to remove the outbound rule.aws ec2 revoke-security-group-egress - 7.
Double-check that no rules allowing inbound or outbound traffic for FedRAMP Moderate Revision 4 remain in the default security group.
- 8.
Save the changes if necessary.
By following these steps, you will ensure that the VPC default security group disallows inbound and outbound traffic for FedRAMP Moderate Revision 4, in compliance with the specified security requirements.