> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Unrestricted https access remediation ### Triage and Remediation ### Remediation To remediate the "Unrestricted HTTPS Access Should Not Be Allowed" misconfiguration in AWS, you can follow these steps: 1. Log in to the AWS Management Console. 2. Navigate to the AWS EC2 service. 3. Click on the "Security Groups" option from the left-hand menu. 4. Select the security group that is associated with the instance(s) that have unrestricted HTTPS access. 5. Click on the "Inbound Rules" tab. 6. Locate the HTTPS rule that has unrestricted access (i.e., source is set to "0.0.0.0/0" or "::/0"). 7. Click on the "Edit" button for the rule. 8. Change the source to a more restrictive IP range or security group that requires HTTPS access. 9. Click on the "Save Rules" button to apply the changes. Note: If you are unsure which security group is associated with the instance(s) that have unrestricted HTTPS access, you can view the instance details to find the security group ID and then navigate to the Security Groups section to find the security group. # To remediate the misconfiguration of unrestricted HTTPS access in AWS using AWS CLI, follow these steps: Step 1: Open the AWS CLI in your terminal or command prompt. Step 2: Run the following command to list all the security groups in your AWS account: ``` aws ec2 describe-security-groups ``` Step 3: Identify the security group(s) that have unrestricted HTTPS access allowed. Step 4: Run the following command to remove the HTTPS access rule from the identified security group(s): ``` aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 443 --cidr 0.0.0.0/0 ``` Note: Replace `` with the actual ID of the security group that needs to be remediated. Step 5: Verify that the HTTPS access rule has been removed by running the following command: ``` aws ec2 describe-security-groups --group-id ``` Note: Replace `` with the actual ID of the security group that was remediated. Step 6: Repeat the above steps for all the security groups that have unrestricted HTTPS access allowed. By following the above steps, you can remediate the misconfiguration of unrestricted HTTPS access in AWS using AWS CLI. To remediate the unrestricted HTTPS access issue in AWS using Python, you can follow the below steps: 1. Identify the Security Group(s) which are allowing unrestricted HTTPS access. 2. Using the AWS SDK for Python (Boto3), modify the inbound rules of the identified Security Group(s) to allow HTTPS access only from trusted sources. 3. Create a script to automate this process for all the Security Group(s) in your AWS account. Here is a sample Python code to remediate the issue: ``` import boto3 # Define the AWS region and security group id region = 'us-east-1' security_group_id = 'sg-0123456789abcdef' # Create an EC2 client ec2 = boto3.client('ec2', region_name=region) # Get the existing inbound rules of the security group response = ec2.describe_security_groups(GroupIds=[security_group_id]) # Modify the inbound rules to allow HTTPS access only from trusted sources ec2.authorize_security_group_ingress( GroupId=security_group_id, IpPermissions=[ { 'IpProtocol': 'tcp', 'FromPort': 443, 'ToPort': 443, 'IpRanges': [ { 'CidrIp': 'trusted_ip_address/32' } ] } ] ) ``` Note: Replace the `region` and `security_group_id` variables with your own values. Also, replace the `trusted_ip_address` with the IP address(es) of the trusted sources that should be allowed HTTPS access. ```hcl theme={null} resource "aws_security_group" "WEB_SG" { name = "WEB_SG_NAME" # replace with your SG name description = "Security group for WEB_SG purpose" vpc_id = "VPC_ID" # replace with your VPC ID # Example: allow HTTPS only from trusted IPv4 range(s) ingress { description = "HTTPS from trusted IPv4 range" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = [ "TRUSTED_IPV4_CIDR_1", # e.g. "203.0.113.0/24" # add more trusted ranges as needed ] } # Example: allow HTTPS only from trusted IPv6 range(s) (optional) # Omit this block entirely if you do not need IPv6 access. ingress { description = "HTTPS from trusted IPv6 range" from_port = 443 to_port = 443 protocol = "tcp" ipv6_cidr_blocks = [ "TRUSTED_IPV6_CIDR_1", # e.g. "2001:db8:1234::/64" # add more trusted ranges as needed ] } # Other, non-HTTPS rules can stay as required; just ensure there is # no rule with port 443 and cidr_blocks = ["0.0.0.0/0"] or # ipv6_cidr_blocks = ["::/0"]. egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6_cidr_blocks = ["::/0"] } tags = { Name = "WEB_SG_TAG_NAME" # replace with desired tag } } ``` This Terraform configuration removes any ingress rule that allows TCP port 443 from 0.0.0.0/0 or ::/0 and replaces it with rules restricted to trusted CIDR ranges, matching the effect of revoking those unrestricted rules via the AWS CLI. The change is in-place and does not replace the security group itself, but it may disrupt connectivity for clients outside the trusted ranges. To verify, `terraform plan` should show: * Removal of any existing `ingress` blocks with `from_port = 443`, `to_port = 443`, and `cidr_blocks = ["0.0.0.0/0"]` and/or `ipv6_cidr_blocks = ["::/0"]`. * Addition (or update) of `ingress` blocks so that port 443 is only allowed from the specified trusted IPv4/IPv6 CIDR ranges.