Security group rules counts remediation

Using Console

The misconfiguration “Security Group Rules Counts” indicates that one or more of your AWS security groups have too many or too few rules. This could potentially lead to security vulnerabilities or unwanted access to your resources. Here are the steps to remediate this misconfiguration:

Log in to your AWS console.
Navigate to the EC2 service.
Click on “Security Groups” in the left-hand menu.
Select the security group that you want to remediate.
Click on the “Inbound Rules” tab.
Review the rules and remove any unnecessary or redundant rules.
Ensure that the remaining rules are necessary and correctly configured.
Click on the “Outbound Rules” tab.
Review the rules and remove any unnecessary or redundant rules.
Ensure that the remaining rules are necessary and correctly configured.
Click on the “Save” button to apply the changes.

Repeat these steps for any other security groups that have too many or too few rules. It is important to regularly review and update your security groups to ensure that they are properly configured and minimize your attack surface.

Using CLI

The “Security Group Rules Counts” misconfiguration in AWS occurs when a security group has too many or too few rules, which could potentially leave the associated resources exposed or inaccessible. Here are the step-by-step instructions to remediate this misconfiguration using AWS CLI:

First, identify the security group that has the misconfiguration. You can do this by running the following command:
aws ec2 describe-security-groups --group-ids <security-group-id>
Replace <security-group-id> with the ID of the security group that you want to check.
Check the number of rules in the security group by running the following command:
aws ec2 describe-security-groups --group-ids <security-group-id> --query 'SecurityGroups[*].{Inbound: length(IpPermissions), Outbound: length(IpPermissionsEgress)}'
This command will return the number of inbound and outbound rules in the security group.
If the number of rules is too high or too low, you can remediate the misconfiguration by modifying the security group rules. Use the following command to modify the inbound rules:
aws ec2 authorize-security-group-ingress --group-id <security-group-id> --ip-permissions <ip-permissions>
Replace <security-group-id> with the ID of the security group that you want to modify, and <ip-permissions> with the new inbound rules that you want to add.
Similarly, you can modify the outbound rules by running the following command:
aws ec2 authorize-security-group-egress --group-id <security-group-id> --ip-permissions <ip-permissions>
Replace <security-group-id> with the ID of the security group that you want to modify, and <ip-permissions> with the new outbound rules that you want to add.
After modifying the security group rules, you can verify that the misconfiguration has been remediated by running the command in step 2 again. If the number of rules is now within the recommended range, the misconfiguration has been successfully remediated.

Using Python

The misconfiguration “Security Group Rules Counts” refers to a security group in AWS that has too many or too few rules. Here are the step-by-step instructions to remediate this issue using Python:

Log in to your AWS account and open the EC2 console.
Select the security group that you want to remediate.
Count the number of inbound and outbound rules for the security group.
If the number of rules is too high, you can remove some of the unnecessary rules to reduce the count. If the number of rules is too low, you can add additional rules to meet your requirements.
To automate this process using Python, you can use the AWS SDK for Python (Boto3).
First, you need to install the Boto3 library using the following command:

pip install boto3

Next, you need to create a Python script that will connect to your AWS account and retrieve the security group rules.
Here is an example Python script that retrieves the rules for a security group and prints the count:

import boto3

# Create an EC2 client
ec2 = boto3.client('ec2')

# Specify the security group ID
security_group_id = 'sg-0123456789abcdefg'

# Retrieve the security group rules
response = ec2.describe_security_groups(GroupIds=[security_group_id])

# Print the count of inbound and outbound rules
inbound_rule_count = len(response['SecurityGroups'][0]['IpPermissions'])
outbound_rule_count = len(response['SecurityGroups'][0]['IpPermissionsEgress'])

print('Inbound rule count:', inbound_rule_count)
print('Outbound rule count:', outbound_rule_count)

You can modify this script to remove or add rules as needed based on the count of rules. For example, to remove a rule, you can use the following code:

# Remove a rule from the security group
ec2.revoke_security_group_ingress(
    GroupId=security_group_id,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 80,
            'ToPort': 80,
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0'
                }
            ]
        }
    ]
)

Finally, you can schedule this Python script to run periodically to ensure that your security groups always have the correct number of rules.

Using Terraform

# Review all rules on this security group and REMOVE the ones that are not needed.
# Example: a security group whose excessive rules you are cleaning up
resource "aws_security_group" "APP_SG" {
  name        = "APP_SG"                  # replace with your SG name
  description = "Application security group"
  vpc_id      = VPC_ID                    # replace with your VPC ID

  # Keep only the rules you have verified as required.
  # Do NOT re‑add any unnecessary rules you intend to remove.
}

# EXAMPLE of an unnecessary inbound rule that should be removed
# (matches the aws ec2 revoke-security-group-ingress example)
# DELETE this entire resource from your Terraform if the rule is not needed.
resource "aws_security_group_rule" "UNNECESSARY_HTTP_INGRESS" {
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.APP_SG.id
}

# EXAMPLE of an unnecessary outbound rule that should be removed
# (matches the aws ec2 revoke-security-group-egress example)
# DELETE this entire resource from your Terraform if the rule is not needed.
resource "aws_security_group_rule" "UNRESTRICTED_EGRESS" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.APP_SG.id
}

You remediate this finding by identifying which aws_security_group_rule resources (or inline ingress/egress blocks on aws_security_group) are unnecessary and deleting them from Terraform so the total rule count for the security group is ≤ 50.Deleting a security group rule is a destructive action that can cause application outages; you must manually review each rule and remove only those that are confirmed unused or redundant.Verification: terraform plan should show - destroy for each removed aws_security_group_rule (or for specific ingress/egress blocks in the diff of aws_security_group) and no replacement rules being created for them.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Security group rules counts remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation