Ensure VPC Security Groups Restrict Ingress Access Rule

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify the existing security group rules:

   • Go to the AWS Management Console.
   • Navigate to the VPC service.
   • Select the appropriate VPC.
   • Click on "Security Groups" in the left sidebar.
   • Identify the security group associated with the affected resources.
   • Review the inbound rules to check if any open access from 0.0.0.0/0 on the specified ports is present.
4. 2.

   Check if any necessary exceptions are required:

   • Determine if there are any specific requirements for allowing access on the mentioned ports from certain IP ranges or specific resources. Keep in mind that these exceptions should be kept to a minimum and follow the principle of least privilege.
6. 3.

   Update the security group rules:

   • Modify the existing security group rules to restrict ingress access on ports 20, 21, 22, 3306, 3389, and 4333 from the IP range 0.0.0.0/0.
   • Remove any existing rules that allow unrestricted access on these ports.
   • Add explicit rules that allow access only from the required IP ranges or specific resources, if applicable.
8. 4.

   Test the updated configuration:

   • Verify that the updated security group rules are now in effect.
   • Test the connectivity to the affected resources on the restricted ports from both allowed and disallowed IP addresses.
   • Ensure that the necessary access is allowed while unauthorized access is denied.

Necessary Codes:

Step-by-step Guide for Remediation:

2. 1.
   Open the AWS Management Console.
4. 2.
   Go to the VPC service.
6. 3.
   Select the appropriate VPC.
8. 4.
   Click on "Security Groups" in the left sidebar.
10. 5.
    Identify the security group associated with the affected resources.
12. 6.
    Review the existing inbound rules.
14. 7.
    Modify the security group rules as follows:

    • Remove any existing rules that allow unrestricted access on ports 20, 21, 22, 3306, 3389, and 4333.
    • Add new inbound rules for each of the mentioned ports to allow access only from the required IP ranges or specific resources.
16. 8.
    Save the updated security group configuration.
18. 9.
    Test the updated configuration by attempting to access the affected resources on the restricted ports.

    • Confirm that access is allowed from the specified IP ranges or specific resources.
    • Ensure that access from unauthorized IP addresses is denied.
20. 10.
    If required, document the changes made and update any relevant documentation or runbooks.