Unrestricted RDP Access Should Not Be Allowed

More Info:

No AWS EC2 security group should allow unrestricted inbound access to TCP port 3389 (RDP).

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS AWS
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• FedRAMP
• GDPR
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the unrestricted RDP access issue in AWS, you can follow these steps:

1. Login to the AWS Management Console.

2. Navigate to the EC2 service.

3. Select the EC2 instance(s) for which you want to restrict RDP access.

4. Click on the "Security Groups" tab in the bottom pane.

5. Select the security group(s) associated with the instance(s).

6. Click on the "Inbound Rules" tab.

7. Locate the rule that allows RDP access from any IP address (0.0.0.0/0).

8. Click on the "Edit" button next to the rule.

9. Change the source IP address to a specific IP address or range of IP addresses that are allowed to access RDP.

10. Click on the "Save" button to apply the changes.

11. Repeat these steps for all instances that have unrestricted RDP access.

By following these steps, you can remediate the unrestricted RDP access issue in AWS and restrict RDP access to specific IP addresses only.

Using CLI

To remediate the unrestricted RDP access in AWS, you can follow the below steps using AWS CLI:

1. Open the AWS CLI on your local machine.

2. Run the below command to list all the security groups in your AWS account.

aws ec2 describe-security-groups

3. Identify the security group that allows unrestricted RDP access.

4. Run the below command to revoke the inbound rule that allows unrestricted RDP access.

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 3389 --cidr 0.0.0.0/0

Note: Replace <security-group-id> with the ID of the security group identified in step 3.

5. Verify that the inbound rule has been revoked by running the below command.

aws ec2 describe-security-groups --group-ids <security-group-id>

Note: Replace <security-group-id> with the ID of the security group identified in step 3.

6. Repeat steps 3 to 5 for all the security groups that allow unrestricted RDP access.

By following the above steps, you can remediate the unrestricted RDP access in AWS.

Using Python

To remediate unrestricted RDP access in AWS using Python, you can follow these steps:

1. Import the necessary AWS SDK libraries in your Python script. You can use the Boto3 library to interact with AWS services.

import boto3

2. Initialize the EC2 client using the Boto3 library.

ec2 = boto3.client('ec2')

3. Use the describe_security_groups method to get a list of all security groups in your AWS account.

response = ec2.describe_security_groups()
security_groups = response['SecurityGroups']

4. Loop through the security groups and check if any of them have an inbound rule allowing unrestricted RDP access (port 3389).

for sg in security_groups:
    for rule in sg['IpPermissions']:
        if rule['IpProtocol'] == 'tcp' and rule['FromPort'] == 3389 and rule['ToPort'] == 3389 and rule['IpRanges'] == [{'CidrIp': '0.0.0.0/0'}]:
            # Remove the rule that allows unrestricted RDP access
            ec2.revoke_security_group_ingress(
                GroupId=sg['GroupId'],
                IpPermissions=[rule]
            )

5. Save the Python script and run it to remove the rule that allows unrestricted RDP access in all security groups in your AWS account.

Note: Make sure you have the necessary permissions to modify security groups in your AWS account before running the script.

Using Terraform

resource "aws_security_group" "rdp_restricted" {
  name        = "RDP_RESTRICTED_SG_NAME"        # replace with your SG name
  description = "Security group without unrestricted RDP"
  vpc_id      = "VPC_ID"                        # replace with your VPC ID

  # Example: allow RDP only from a trusted admin IP range (optional)
  # Remove this block entirely if you do not want RDP at all.
  ingress {
    description = "Restricted RDP access"
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["TRUSTED_ADMIN_IP_CIDR"]     # e.g. "203.0.113.10/32"
    # ipv6_cidr_blocks = ["TRUSTED_ADMIN_IPV6_CIDR"]  # e.g. "2001:db8::/64"
  }

  # Other, non-RDP rules can remain as needed
  # Do NOT include any of the following:
  # - cidr_blocks      = ["0.0.0.0/0"] with from_port/to_port including 3389
  # - ipv6_cidr_blocks = ["::/0"]      with from_port/to_port including 3389

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "RDP_RESTRICTED_SG_TAG_NAME"         # replace with your SG tag name
  }
}

This Terraform configuration removes any ingress rule that allows TCP port 3389 (RDP) from 0.0.0.0/0 or ::/0 and optionally replaces it with a more restrictive rule; ensure you have an alternative secure access method (VPN, bastion, etc.) before applying, as public RDP access will be lost.

If your current configuration has a wider port range that includes 3389 (for example from_port = 1024, to_port = 65535 with cidr_blocks = ["0.0.0.0/0"]), you must remove that entire ingress block and, if needed, add back narrower, more specific rules that do not publicly expose 3389.

This change updates the security group in place; it does not force resource replacement.

To verify, run terraform plan and confirm:

• Any existing ingress rule with protocol = "tcp", from_port/to_port including 3389 and cidr_blocks = ["0.0.0.0/0"] and/or ipv6_cidr_blocks = ["::/0"] is shown as being removed.
• (Optionally) a new, more restrictive ingress rule for port 3389 from specific IP ranges is shown as being added.

Additional Reading:

• https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#AddRemoveRules