Rule: VPC Security Groups Should Restrict Ingress Access on Common Ports

Description

Remediation

2. 1.

   Identify the VPC security group that needs to be updated. You can use the AWS Management Console, AWS Command Line Interface (CLI), or AWS SDKs/APIs to list all the VPC security groups within your AWS account.

4. 2.

   Once you have identified the security group, make sure you have the necessary permissions to modify it.

6. 3.

   Determine the current inbound rules for the security group. Again, you can use the AWS Management Console, AWS CLI, or AWS SDKs/APIs to retrieve the existing inbound rules.

8. 4.

   Review the existing inbound rules and confirm if any of the ports (20, 21, 22, 3306, 3389, and 4333) have unrestricted access from 0.0.0.0/0.

10. 5.

    If there are any inbound rules allowing access from 0.0.0.0/0 on these ports, update the security group to restrict the ingress access. Depending on your preferred method of making the changes, you can either use the AWS Management Console or CLI.

    Using AWS Console:

    • Open the AWS Management Console and navigate to the EC2 dashboard.
    • From the navigation pane, click on "Security Groups" under the "NETWORK & SECURITY" category.
    • Locate the required security group and select it.
    • In the "Inbound rules" tab, find the rule corresponding to the port that needs to be updated.
    • Edit the rule and change the source IP from "0.0.0.0/0" to a more restricted IP range or specific IP addresses.
    • Save the changes.

    Using AWS CLI:

    • Open the AWS CLI or terminal.

    • Execute the following command, replacing

      <security-group-id>

      with the actual ID of the security group and

      <port>

      with the appropriate port number (20, 21, 22, 3306, 3389, or 4333):

      aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port <port> --cidr 0.0.0.0/0
      

    Note: Repeat the above command for each port that needs to be updated.

12. 6.

    After updating the security group with the appropriate ingress rules, verify the changes to ensure that access from 0.0.0.0/0 has been restricted as intended.

Troubleshooting

2. 1.

   Validate that you are modifying the correct security group. Double-check the security group ID or name to ensure you are updating the intended group.

4. 2.

   Verify that you have the necessary permissions to modify security groups. If you encounter permission errors, contact your AWS account administrator or security team to grant you the required permissions.

6. 3.

   Check if there are any conflicting security group rules that might override the changes you are attempting to make. Review and update any conflicting rules accordingly.

8. 4.

   If you are using the AWS CLI, ensure that your CLI environment is properly configured with the correct AWS credentials. Refer to the AWS CLI documentation for assistance with configuration.

10. 5.

    If the changes do not take effect immediately, check for any network caching or propagation delays. In some cases, it may take a few minutes for the changes to propagate across the network.