Non-Default Security Groups Should Be Attached To Elastic Network Interface

​

More Info:

Ensure that security groups are attached to elastic network interface

​

Risk Level

Medium

​

Address

Operational Maturity, Reliability, Security

​

Compliance Standards

HITRUST

​

Remediation

​

Using Console

To remediate the misconfiguration “Non-Default Security Groups Should Be Attached To Elastic Network Interface” for AWS EC2 using the AWS Management Console, follow these step-by-step instructions:

1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.

2. Navigate to EC2 Dashboard: Click on the “Services” dropdown menu at the top left corner, select “EC2” under the Compute section.

3. Locate the Elastic Network Interface (ENI): In the EC2 Dashboard, click on “Network Interfaces” in the left-hand navigation pane to locate the relevant ENI that needs to be remediated.

4. Identify the Security Group: Select the specific ENI that is associated with the non-default security group that needs to be attached.

5. Modify the Security Group: Click on the “Actions” dropdown menu at the top, and select “Change Security Groups”.

6. Select the Correct Security Group: In the “Change Security Groups” dialog box, select the correct security group(s) that you want to attach to the ENI. Ensure that you select at least one non-default security group.

7. Apply the Changes: Click on the “Save” button to apply the changes and attach the selected security group(s) to the ENI.

8. Verify the Configuration: After saving the changes, verify that the non-default security group has been successfully attached to the ENI by checking the details of the ENI.

By following these steps, you will be able to remediate the misconfiguration “Non-Default Security Groups Should Be Attached To Elastic Network Interface” for AWS EC2 using the AWS Management Console.

​

Using CLI

To remediate the misconfiguration “Non-Default Security Groups Should Be Attached To Elastic Network Interface” for AWS EC2 using AWS CLI, follow these steps:

1. List all the Elastic Network Interfaces (ENIs) in your AWS account:

aws ec2 describe-network-interfaces

2. Identify the ENI that is not attached to a non-default security group and note down its ID.

3. List all the security groups in your AWS account:

aws ec2 describe-security-groups

4. Identify the non-default security group that you want to attach to the ENI and note down its ID.

5. Attach the non-default security group to the ENI using the following command:

aws ec2 modify-network-interface-attribute --network-interface-id <ENI_ID> --groups <Security_Group_ID>

Replace <ENI_ID> with the ID of the ENI and <Security_Group_ID> with the ID of the non-default security group.

6. Verify that the non-default security group has been successfully attached to the ENI:

aws ec2 describe-network-interfaces --network-interface-ids <ENI_ID>

By following these steps, you can remediate the misconfiguration “Non-Default Security Groups Should Be Attached To Elastic Network Interface” for AWS EC2 using AWS CLI.

​

Using Python

To remediate the misconfiguration of non-default security groups not being attached to Elastic Network Interface (ENI) for AWS EC2 instances using Python, you can follow these steps:

1. Install and configure the AWS SDK for Python (Boto3) on your local machine. You can install it using pip:

pip install boto3

2. Write a Python script to identify EC2 instances with non-default security groups attached to their ENIs. Here’s a sample script that accomplishes this:

import boto3

# Initialize the EC2 client
ec2_client = boto3.client('ec2')

# Get a list of all EC2 instances
instances = ec2_client.describe_instances()

# Iterate through each instance
for reservation in instances['Reservations']:
    for instance in reservation['Instances']:
        instance_id = instance['InstanceId']
        
        # Get the list of security groups attached to the instance's ENIs
        enis = instance.get('NetworkInterfaces', [])
        for eni in enis:
            security_groups = eni.get('Groups', [])
            
            # Check if any non-default security groups are attached to the ENI
            for sg in security_groups:
                if 'default' not in sg['GroupName']:
                    print(f"Instance {instance_id} has a non-default security group attached to ENI {eni['NetworkInterfaceId']}")
                    
                    # You can add remediation steps here to attach the default security group to the ENI
                    # ec2_client.modify_network_interface_attribute(NetworkInterfaceId=eni['NetworkInterfaceId'], Groups=['default'])

3. Run the Python script to identify instances with non-default security groups attached to their ENIs. The script will print out the instance IDs and ENI IDs for instances with non-default security groups attached.

4. To remediate the misconfiguration, you can uncomment the remediation steps in the script to attach the default security group to the ENI. This can be done using the modify_network_interface_attribute method in Boto3.

5. Run the script again to apply the remediation steps and ensure that all instances have default security groups attached to their ENIs.

By following these steps, you can remediate the misconfiguration of non-default security groups not being attached to Elastic Network Interface (ENI) for AWS EC2 instances using Python and Boto3.