Skip to main content

Unrestricted HTTP Access Should Not Be Allowed

More Info:​

No security group should allow unrestricted inbound access to TCP port 80 (HTTP).

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • GDPR
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of unrestricted HTTP access in AWS, you can follow the below steps:

  1. Login to your AWS console.
  2. Go to the EC2 dashboard.
  3. Click on the "Security Groups" option on the left-hand side menu.
  4. Select the security group that is associated with the instance that has unrestricted HTTP access.
  5. Click on the "Inbound Rules" tab.
  6. Find the rule that allows unrestricted HTTP access (port 80).
  7. Click on the "Edit" button for that rule.
  8. Change the source from "0.0.0.0/0" to a specific IP address or range of IP addresses that you want to allow access from.
  9. Click on the "Save" button to save the changes.

By following these steps, you have remediated the issue of unrestricted HTTP access in AWS by restricting access to a specific IP address or range of IP addresses.

Using CLI

To remediate the "Unrestricted HTTP Access Should Not Be Allowed" misconfiguration in AWS using AWS CLI, you can follow the below steps:

  1. Open the AWS CLI on your local machine.

  2. Run the following command to list all the security groups in your AWS account:

    aws ec2 describe-security-groups

  3. Identify the security group that has unrestricted HTTP access. You can do this by looking for security groups that have port 80 open to the entire internet (0.0.0.0/0).

  4. Once you have identified the security group, run the following command to update the inbound rules of the security group to only allow HTTP access from specific IP addresses or CIDR blocks:

    aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 80 --cidr 0.0.0.0/0

    Note: Replace <security-group-id> with the ID of the security group that you want to remediate.

  5. After running the above command, you can verify that the inbound rule for port 80 has been updated by running the following command:

    aws ec2 describe-security-groups --group-ids <security-group-id>

    Note: Replace <security-group-id> with the ID of the security group that you updated.

  6. Verify that the inbound rule for port 80 is now restricted to specific IP addresses or CIDR blocks.

By following the above steps, you can remediate the "Unrestricted HTTP Access Should Not Be Allowed" misconfiguration in AWS using AWS CLI.

Using Python

To remediate the unrestricted HTTP access misconfiguration in AWS using Python, you can follow these steps:

  1. Identify the security group(s) associated with the EC2 instance(s) that have unrestricted HTTP access.

  2. Use the AWS SDK for Python (boto3) to modify the inbound rules of the security group(s) to allow HTTP access only from trusted sources.

Here's a sample Python code snippet to remediate the misconfiguration:

import boto3

# Replace <SECURITY_GROUP_ID> with the ID of the security group that needs to be remediated
security_group_id = '<SECURITY_GROUP_ID>'

# Create an EC2 client
ec2 = boto3.client('ec2')

# Get the current inbound rules of the security group
response = ec2.describe_security_groups(GroupIds=[security_group_id])
current_rules = response['SecurityGroups'][0]['IpPermissions']

# Modify the inbound rules to allow HTTP access only from trusted sources
new_rules = [
    {
        'IpProtocol': 'tcp',
        'FromPort': 80,
        'ToPort': 80,
        'IpRanges': [
            {
                'CidrIp': '<TRUSTED_CIDR>',
                'Description': 'Allow HTTP access from trusted source'
            }
        ]
    }
]

# Revoke the existing rules and authorize the new rules
ec2.revoke_security_group_ingress(GroupId=security_group_id, IpPermissions=current_rules)
ec2.authorize_security_group_ingress(GroupId=security_group_id, IpPermissions=new_rules)

In the above code, replace <SECURITY_GROUP_ID> with the ID of the security group that needs to be remediated and <TRUSTED_CIDR> with the CIDR block of the trusted source that should have HTTP access to the EC2 instance(s).

Note: Make sure to test this code in a non-production environment before applying it to a production environment.

Using Terraform
resource "aws_security_group" "WEB_SG" {
  name        = "WEB_SG"
  description = "Security group for HTTP application"
  vpc_id      = AWS_VPC_ID   # replace with your VPC ID

  # NOTE: The overly permissive rules have been REMOVED:
  # - No ingress with from_port/to_port 80 and cidr_blocks = ["0.0.0.0/0"]
  # - No ingress with from_port/to_port 80 and ipv6_cidr_blocks = ["::/0"]

  # If HTTP is still required, add a more restrictive rule instead, for example:
  ingress {
    description      = "HTTP from trusted IPv4 range"
    from_port        = 80
    to_port          = 80
    protocol         = "tcp"
    cidr_blocks      = ["TRUSTED_IPV4_CIDR"]  # e.g. "203.0.113.0/24"
    ipv6_cidr_blocks = []                     # ensure "::/0" is NOT present
  }

  # other existing rules (SSH, HTTPS, etc.) go here

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "WEB_SG"
  }
}

If you manage rules with separate resources, delete or tighten only the offending rules:

# DELETE this resource entirely if it exists (revokes IPv4 0.0.0.0/0 on port 80)
resource "aws_security_group_rule" "web_http_ipv4_all" {
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.WEB_SG.id
}

# DELETE this resource entirely if it exists (revokes IPv6 ::/0 on port 80)
resource "aws_security_group_rule" "web_http_ipv6_all" {
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  ipv6_cidr_blocks  = ["::/0"]
  security_group_id = aws_security_group.WEB_SG.id
}

# Optionally replace with a restricted rule:
resource "aws_security_group_rule" "web_http_ipv4_restricted" {
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  cidr_blocks       = ["TRUSTED_IPV4_CIDR"]  # e.g. "203.0.113.0/24"
  security_group_id = aws_security_group.WEB_SG.id
}

Changing or removing these rules does not replace the security group itself, but it can immediately impact application availability if clients depended on 0.0.0.0/0 or ::/0 access.

Verification: terraform plan should show the ingress rules that allow TCP/80 from 0.0.0.0/0 and/or ::/0 being destroyed or modified to use a restricted CIDR, with no remaining rule that has from_port = 80, to_port = 80, and those unrestricted CIDRs.

Additional Reading:​