Skip to main content

Non-Empty Stateless Network Firewall Rule Groups Should Not

More Info:​

This rule checks if a stateless Network Firewall Rule Group contains rules. It ensures that there are rules defined in the stateless Network Firewall Rule Group. The rule is marked as non-compliant if there are no rules in the stateless Network Firewall Rule Group.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the non-empty stateless network firewall rule groups in AWS EC2 using AWS console, follow these steps:

  1. Open the Amazon VPC Console: Go to the AWS Management Console, navigate to the VPC service.

  2. Navigate to Security Groups: In the VPC dashboard, click on "Security Groups" in the left-hand menu.

  3. Identify the Security Group: Identify the security group that has non-empty stateless network firewall rule groups. You can check the rules defined in each security group to find the non-empty ones.

  4. Edit the Security Group: Select the security group that needs to be remediated and click on the "Inbound Rules" or "Outbound Rules" tab, depending on where the non-empty rule group is present.

  5. Remove Non-Empty Stateless Rules: Look for any rules that are not required or are unnecessarily broad. To remove a rule, select it and click on the "Delete" or "Remove" button.

  6. Add Necessary Rules: If any necessary rules were inadvertently removed, add them back in a way that follows the principle of least privilege. Click on the "Add Rule" button to define a new rule.

  7. Review and Save Changes: Once you have removed the non-empty stateless rules and added any necessary rules, review the changes to ensure they align with your security requirements. Click on the "Save" or "Apply" button to apply the changes.

  8. Verify the Security Group: After saving the changes, verify that the security group no longer contains any non-empty stateless network firewall rule groups.

By following these steps, you can successfully remediate the non-empty stateless network firewall rule groups in AWS EC2 using the AWS console.

Using CLI

To remediate the issue of having non-empty stateless network firewall rule groups in AWS EC2 using AWS CLI, follow these steps:

  1. List all the security groups in your AWS account using the following AWS CLI command:
aws ec2 describe-security-groups

  1. Identify the security group that has non-empty stateless network firewall rule groups. Look for the security group with the IpPermissions attribute that contains rules.

  2. Note down the Group ID of the security group that needs to be remediated.

  3. Remove all the inbound and outbound rules from the identified security group using the following AWS CLI command:

aws ec2 revoke-security-group-ingress --group-id YOUR_SECURITY_GROUP_ID --protocol all --port all --cidr 0.0.0.0/0
aws ec2 revoke-security-group-egress --group-id YOUR_SECURITY_GROUP_ID --protocol all --port all --cidr 0.0.0.0/0

Replace YOUR_SECURITY_GROUP_ID with the actual Group ID of the identified security group.

  1. Verify that the security group no longer has any inbound or outbound rules by describing the security group using the following AWS CLI command:
aws ec2 describe-security-groups --group-ids YOUR_SECURITY_GROUP_ID
  1. Once you have confirmed that the security group is now empty, you have successfully remediated the issue of having non-empty stateless network firewall rule groups in AWS EC2.

By following these steps, you can effectively remediate the misconfiguration of having non-empty stateless network firewall rule groups in AWS EC2 using AWS CLI.

Using Python

To remediate the misconfiguration of having non-empty stateless network firewall rule groups in AWS EC2 using Python, you can follow these steps:

  1. Use the AWS SDK for Python (Boto3) to interact with the AWS EC2 service.

  2. List all the security groups associated with your EC2 instances.

  3. For each security group, check if there are any stateless network firewall rule groups that are not empty.

  4. If you find any non-empty stateless network firewall rule groups, remove the rules from the security group.

  5. Here is a sample Python code snippet that demonstrates how to achieve this:

import boto3

# Initialize the EC2 client
ec2_client = boto3.client('ec2')

# Get all security groups
response = ec2_client.describe_security_groups()

for sg in response['SecurityGroups']:
    group_id = sg['GroupId']
    
    # Check if the security group is stateless and non-empty
    if sg['IpPermissionsEgress'] and not sg['IpPermissions']:
        
        # Remove all egress rules from the security group
        ec2_client.revoke_security_group_egress(GroupId=group_id, IpPermissions=sg['IpPermissionsEgress'])
        
        print(f"Revoked egress rules for security group: {group_id}")

  1. Make sure to replace the placeholder values like YourRegion and YourProfile with your actual AWS region and profile name in the code snippet.

  2. Run the Python script to remediate the non-empty stateless network firewall rule groups in your AWS EC2 security groups.

By following these steps and running the provided Python script, you can remediate the misconfiguration of having non-empty stateless network firewall rule groups in AWS EC2.

Using Terraform
# Remove the empty stateless rule group from any firewall policy first
resource "aws_networkfirewall_firewall_policy" "this" {
  name = "FIREWALL_POLICY_NAME" # replace with your firewall policy name

  firewall_policy {
    stateless_default_actions          = ["aws:forward_to_sfe"]
    stateless_fragment_default_actions = ["aws:forward_to_sfe"]

    # Make sure any reference to the empty stateless rule group is removed
    # from these lists:
    # stateless_rule_group_references  = []
    # stateful_rule_group_references   = []
  }

  tags = {
    Name = "FIREWALL_POLICY_TAG_NAME" # replace as needed
  }
}

# Delete the empty stateless Network Firewall rule group
# by telling Terraform not to manage/create it anymore.
# If this resource already exists in your state, changing count from 1 to 0
# will cause Terraform to destroy it.
resource "aws_networkfirewall_rule_group" "empty_stateless" {
  count = 0
  # When count was 1, this described the empty stateless rule group:
  # name     = "EMPTY_STATELESS_RULE_GROUP_NAME" # replace with your rule group name
  # capacity = 100
  # type     = "STATELESS"
  #
  # rule_group {
  #   rule_variables {}
  #   rules_source {
  #     stateless_rules_and_custom_actions {}
  #   }
  # }
}

# NOTE: Setting count = 0 (or completely removing this resource block from your
# Terraform configuration) will force Terraform to destroy the existing
# aws_networkfirewall_rule_group, which is permanent and cannot be undone.
# The apply will also fail if the rule group is still referenced by a firewall policy.

Verification with terraform plan should show the aws_networkfirewall_rule_group.empty_stateless resource scheduled for destruction (e.g., Plan: 0 to add, 0 to change, 1 to destroy) and no remaining references to it in aws_networkfirewall_firewall_policy.this.

Additional Reading:​