> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Unrestricted rpc access remediation ### Triage and Remediation ### Remediation To remediate the issue of unrestricted RPC access in AWS, you can follow these steps: 1. Open the AWS Management Console and go to the EC2 dashboard. 2. Click on the "Security Groups" option in the left-hand menu. 3. Select the security group that is allowing unrestricted RPC access. 4. Click on the "Inbound Rules" tab and locate the rule that allows RPC access. 5. Click on the "Edit" button next to the rule. 6. Change the source IP address to a specific IP address or range of IP addresses that require access to RPC. 7. If necessary, add a new rule to allow access to RPC from specific IP addresses or ranges. 8. Click on the "Save" button to apply the changes. Once the changes are saved, the security group will no longer allow unrestricted RPC access. It is important to regularly review and update security group rules to ensure that they are properly configured and do not leave any vulnerabilities open to attack. # To remediate the "Unrestricted RPC Access Should Not Be Allowed" misconfiguration in AWS using AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine. 2. Run the following command to list the security groups in your AWS account: ``` aws ec2 describe-security-groups ``` 3. Identify the security group that has the unrestricted RPC access. 4. Run the following command to modify the security group and remove the unrestricted RPC access: ``` aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 111 --cidr 0.0.0.0/0 ``` Note: Replace `` with the ID of the security group that has the unrestricted RPC access. 5. Run the following command to verify that the unrestricted RPC access has been removed: ``` aws ec2 describe-security-groups --group-ids ``` Note: Replace `` with the ID of the security group that has the unrestricted RPC access. 6. Verify that the remediation was successful by confirming that the security group no longer has unrestricted RPC access. By following these steps, you can remediate the "Unrestricted RPC Access Should Not Be Allowed" misconfiguration in AWS using AWS CLI. To remediate the "Unrestricted RPC Access Should Not Be Allowed" issue in AWS using Python, follow the below steps: 1. First, we need to identify the security group that allows unrestricted RPC access. You can use the following Python code to list all the security groups in your AWS account: ```python theme={null} import boto3 ec2 = boto3.client('ec2') response = ec2.describe_security_groups() for sg in response['SecurityGroups']: print(sg['GroupId'], sg['GroupName']) ``` 2. Once you have identified the security group that allows unrestricted RPC access, you can use the following Python code to revoke the rule: ```python theme={null} import boto3 ec2 = boto3.client('ec2') response = ec2.revoke_security_group_ingress( GroupId='SECURITY_GROUP_ID', IpPermissions=[ { 'IpProtocol': 'tcp', 'FromPort': 135, 'ToPort': 139, 'IpRanges': [{'CidrIp': '0.0.0.0/0'}] }, { 'IpProtocol': 'tcp', 'FromPort': 445, 'ToPort': 445, 'IpRanges': [{'CidrIp': '0.0.0.0/0'}] }, { 'IpProtocol': 'udp', 'FromPort': 137, 'ToPort': 138, 'IpRanges': [{'CidrIp': '0.0.0.0/0'}] } ] ) ``` In the above code, replace 'SECURITY\_GROUP\_ID' with the ID of the security group that allows unrestricted RPC access. 3. The above code will revoke the rule that allows unrestricted RPC access. You can run the first code again to verify that the rule has been revoked. Note: The above code assumes that you have the necessary permissions to modify security groups in your AWS account. ```hcl theme={null} resource "aws_security_group" "RPC_SG" { name = "rpc-sg" description = "Example SG without unrestricted RPC (TCP 135) access" vpc_id = AWS_VPC_ID # replace with your VPC ID # REMOVE any ingress blocks that: # - use protocol "tcp" # - have from_port = 135 and to_port = 135 # - and allow cidr_blocks = ["0.0.0.0/0"] or ipv6_cidr_blocks = ["::/0"] # Example of a more restricted rule (only if truly needed): # ingress { # description = "RPC from a limited CIDR range" # from_port = 135 # to_port = 135 # protocol = "tcp" # cidr_blocks = ["ALLOWED_IPV4_CIDR"] # replace with a specific CIDR, e.g. "10.0.0.0/16" # } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6_cidr_blocks = ["::/0"] } tags = { Name = "RPC SG without unrestricted TCP 135" } } ``` If you manage rules with standalone resources (recommended with current AWS provider), delete the offending resources instead of changing the security group itself: ```hcl theme={null} # DELETE any resources like this that allow 0.0.0.0/0 on TCP 135 resource "aws_vpc_security_group_ingress_rule" "UNRESTRICTED_RPC_IPV4" { security_group_id = AWS_SECURITY_GROUP_ID # replace with your SG ID from_port = 135 to_port = 135 ip_protocol = "tcp" cidr_ipv4 = "0.0.0.0/0" } # DELETE any resources like this that allow ::/0 on TCP 135 resource "aws_vpc_security_group_ingress_rule" "UNRESTRICTED_RPC_IPV6" { security_group_id = AWS_SECURITY_GROUP_ID # replace with your SG ID from_port = 135 to_port = 135 ip_protocol = "tcp" cidr_ipv6 = "::/0" } ``` This change removes the specific rules allowing unrestricted inbound TCP 135; it does not force replacement of the security group itself, only the individual ingress rules. Be aware this may break any workloads that rely on open RPC from the internet. For verification, `terraform plan` should show the offending ingress rule resources being destroyed (`- aws_vpc_security_group_ingress_rule.UNRESTRICTED_RPC_IPV4` / `UNRESTRICTED_RPC_IPV6`) or the corresponding inline `ingress` blocks being removed from the security group.