Unrestricted Outbound Access Should Not Be Allowed

More Info:

EC2 security groups should not allow unrestricted outbound/egress access.

Risk Level

Low

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Startup Security Baseline
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
HIPAA
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the issue of unrestricted outbound access in AWS, follow these steps:

Log in to your AWS console and navigate to the VPC dashboard.
Select the VPC for which you want to restrict outbound access.
Click on the "Security Groups" option in the left-hand menu.
Select the security group that is associated with the instance(s) that have unrestricted outbound access.
Click on the "Outbound Rules" tab.
Remove any rules that allow unrestricted outbound access (i.e., rules with a destination of "0.0.0.0/0" or "::/0").
Add new outbound rules that restrict access to specific IP addresses or ranges, protocols, and ports as per your requirements.
Save the changes and verify that the new outbound rules are in effect.

By following these steps, you can remediate the issue of unrestricted outbound access in AWS and ensure that your instances are only able to communicate with authorized destinations.

Using CLI

To remediate the misconfiguration of unrestricted outbound access in AWS using AWS CLI, follow the below steps:

Open the AWS CLI on your local machine.
Run the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

Identify the security group(s) that have unrestricted outbound access.
Run the following command to revoke the outbound access of the identified security group(s):

aws ec2 revoke-security-group-egress --group-id <security-group-id> --protocol all --cidr 0.0.0.0/0

Note: Replace <security-group-id> with the actual ID of the identified security group.

Verify that the outbound access has been revoked by running the following command:

aws ec2 describe-security-groups --group-ids <security-group-id>

Note: Replace <security-group-id> with the actual ID of the identified security group.

Repeat steps 3-5 for all the security groups that have unrestricted outbound access.

By following these steps, you can remediate the misconfiguration of unrestricted outbound access in AWS using AWS CLI.

Using Python

To remediate the issue of unrestricted outbound access in AWS, you can use the following Python code:

import boto3

# Create the EC2 client
ec2 = boto3.client('ec2')

# Get a list of all security groups
response = ec2.describe_security_groups()

# Iterate through the security groups
for group in response['SecurityGroups']:
    # Get the group ID and group name
    group_id = group['GroupId']
    group_name = group['GroupName']
    
    # Get the outbound rules for the group
    outbound_rules = group['IpPermissionsEgress']
    
    # If there are outbound rules, remove them
    if len(outbound_rules) > 0:
        ec2.revoke_security_group_egress(
            GroupId=group_id,
            IpPermissions=outbound_rules
        )
        
        # Print a message indicating that the outbound rules have been removed
        print(f'Removed outbound rules for security group {group_name} ({group_id})')
    else:
        # Print a message indicating that the security group has no outbound rules
        print(f'Security group {group_name} ({group_id}) has no outbound rules')

This code uses the Boto3 library to interact with the AWS API. It first creates an EC2 client, and then uses the describe_security_groups method to get a list of all security groups in the account. It then iterates through each security group, and checks if there are any outbound rules defined for the group. If there are, it removes them using the revoke_security_group_egress method. Finally, it prints a message indicating whether outbound rules were removed or not for each security group.

Using Terraform

# Security group definition (example)
resource "aws_security_group" "APP_SG" {
  name        = "APP_SG_NAME"          # replace with your SG name
  description = "Security group for APP_DESCRIPTION"
  vpc_id      = "VPC_ID"               # replace with your VPC ID

  # No inline egress blocks here; use standalone aws_vpc_security_group_egress_rule
}

# Remove any existing "allow all" egress rules from Terraform.
# If you currently have rules like these, DELETE them from code:
#
# resource "aws_vpc_security_group_egress_rule" "allow_all_ipv4" {
#   security_group_id = aws_security_group.APP_SG.id
#   ip_protocol       = "-1"
#   cidr_ipv4         = "0.0.0.0/0"
# }
#
# resource "aws_vpc_security_group_egress_rule" "allow_all_ipv6" {
#   security_group_id = aws_security_group.APP_SG.id
#   ip_protocol       = "-1"
#   cidr_ipv6         = "::/0"
# }

# Example least-privilege egress rule: allow only HTTPS (TCP 443) to IPv4 Internet.
# Adjust protocol/ports/CIDRs to match your real application needs.
resource "aws_vpc_security_group_egress_rule" "https_ipv4_egress" {
  security_group_id = aws_security_group.APP_SG.id

  ip_protocol = "tcp"
  from_port   = 443
  to_port     = 443
  cidr_ipv4   = "0.0.0.0/0"
}

Revoking the unrestricted egress rules is a destructive change that can disrupt connectivity; only the security group rule resources will be updated, not the security group itself (no forced replacement). After updating the code, terraform plan should show the aws_vpc_security_group_egress_rule resources with ip_protocol = "-1" to 0.0.0.0/0 and ::/0 being destroyed (if they exist) and the new, specific egress rule(s) being created.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​