> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Default security group unrestricted remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Default Security Group Should Not Allow Unrestricted Public Traffic" for AWS using the AWS console, follow the steps below:

        1. Log in to the AWS Management Console.

        2. Navigate to the EC2 service.

        3. In the left-hand menu, click on "Security Groups".

        4. Select the default security group.

        5. In the "Inbound Rules" tab, remove any rules that allow unrestricted public traffic (i.e. 0.0.0.0/0).

        6. Add specific rules for the required ports and protocols to allow traffic only from authorized sources.

        7. Review and save the changes.

        By following these steps, you will remediate the misconfiguration and ensure that the default security group does not allow unrestricted public traffic.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Default Security Group Should Not Allow Unrestricted Public Traffic" for AWS using AWS CLI, follow the below steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to get the ID of the default security group in your AWS account:

           ```
           aws ec2 describe-security-groups --filters Name=group-name,Values=default --query 'SecurityGroups[*].GroupId' --output text
           ```

        3. Run the following command to update the inbound rules of the default security group to allow only necessary traffic:

           ```
           aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol all --port all --cidr 0.0.0.0/0
           ```

           This command will remove all the inbound rules that allow unrestricted public traffic.

        4. Now, add the necessary inbound rules to the default security group using the following command:

           ```
           aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol tcp --port <port-number> --cidr <ip-address>
           ```

           Replace `<port-number>` with the port number you want to allow traffic for and `<ip-address>` with the IP address range you want to allow traffic from.

        5. Repeat step 4 for all the necessary inbound rules.

        6. Verify the updated inbound rules of the default security group using the following command:

           ```
           aws ec2 describe-security-groups --group-ids <security-group-id>
           ```

           This command will display the updated inbound rules for the default security group.

        By following the above steps, you can remediate the misconfiguration "Default Security Group Should Not Allow Unrestricted Public Traffic" for AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of default security group allowing unrestricted public traffic in AWS using Python, you can follow these steps:

        1. Import the necessary AWS SDK libraries and modules in Python.

        ```
        import boto3
        ```

        2. Create a connection to the AWS EC2 service using the boto3 library.

        ```
        ec2 = boto3.client('ec2')
        ```

        3. Get the default security group ID using the describe\_security\_groups() method.

        ```
        response = ec2.describe_security_groups(GroupNames=['default'])
        sg_id = response['SecurityGroups'][0]['GroupId']
        ```

        4. Revoke the ingress rules that allow unrestricted public traffic using the revoke\_security\_group\_ingress() method.

        ```
        response = ec2.revoke_security_group_ingress(
            GroupId=sg_id,
            IpPermissions=[
                {
                    'IpProtocol': '-1',
                    'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
                }
            ]
        )
        ```

        5. Confirm that the ingress rules have been revoked by describing the security group again.

        ```
        response = ec2.describe_security_groups(GroupNames=['default'])
        print(response)
        ```

        This should remediate the misconfiguration of default security group allowing unrestricted public traffic in AWS using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_default_security_group" "default" {
          # Replace with the VPC where the default SG is misconfigured
          vpc_id = VPC_ID # e.g. aws_vpc.main.id

          # OPTIONAL: keep or define only least‑privilege rules you actually need.
          # The key part of the remediation is that there are NO rules with
          # CidrIp "0.0.0.0/0" or CidrIpv6 "::/0".

          # Example: allow traffic only within the VPC or from specific CIDRs, NOT the internet.
          ingress {
            description = "Allow intra-VPC traffic only"
            from_port   = 0
            to_port     = 0
            protocol    = "-1"
            cidr_blocks = [INTERNAL_CIDR] # e.g. "10.0.0.0/16"
          }

          egress {
            description = "Allow all outbound traffic (adjust if you need stricter egress)"
            from_port   = 0
            to_port     = 0
            protocol    = "-1"
            cidr_blocks = ["0.0.0.0/0"]
            ipv6_cidr_blocks = []
          }
        }
        ```

        * Substitute `VPC_ID` with the ID of the VPC that owns the default security group.
        * Substitute `INTERNAL_CIDR` with your internal network range(s) that should be allowed, or remove/adjust the block per your requirements.
        * This does not force replacement of the default security group; Terraform will update its rules in place, which can impact connectivity just like the CLI `revoke-security-group-ingress` commands.

        For verification, `terraform plan` should show the `aws_default_security_group.default` resource modifying its `ingress` (and possibly `egress`) so that any rules with `cidr_blocks = ["0.0.0.0/0"]` or `ipv6_cidr_blocks = ["::/0"]` on ingress are being removed.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>