> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Unrestricted smtp access remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the unrestricted SMTP access issue in AWS, follow these steps:

        1. Open the AWS Management Console and navigate to the EC2 service.
        2. Select the EC2 instance that is allowing unrestricted SMTP access.
        3. Click on the "Security" tab and scroll down to the "Security groups" section.
        4. Click on the security group that is associated with the instance.
        5. Click on the "Inbound rules" tab.
        6. Locate the rule that allows SMTP traffic (port 25) with the source of "0.0.0.0/0" or "::/0".
        7. Click on the "Edit" button next to the rule.
        8. Change the source to a specific IP address range or security group that requires SMTP access.
        9. Click the "Save" button to apply the changes.

        By following these steps, you have successfully remediated the unrestricted SMTP access issue in AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate this issue in AWS, you can follow the below steps using AWS CLI:

        1. Open the AWS CLI on your local machine or EC2 instance.

        2. Run the following command to list all the active SMTP settings in the AWS account:

        ```
        aws ses get-account-sending-enabled
        ```

        3. If the command output shows that the "SendingEnabled" parameter is set to "true", then you need to disable it. Run the following command to disable SMTP access:

        ```
        aws ses update-account-sending-enabled --no-sending-enabled
        ```

        4. After running the above command, verify that the "SendingEnabled" parameter is set to "false" by running the following command:

        ```
        aws ses get-account-sending-enabled
        ```

        5. If the "SendingEnabled" parameter is set to "false", then SMTP access has been successfully restricted in your AWS account.

        Note: This remediation will disable SMTP access for all users in your AWS account. If you need to enable SMTP access for specific users, you can create an IAM policy that allows SMTP access and attach it to their IAM user or role.
      </Accordion>

      <Accordion title="Using Python">
        To remediate unrestricted SMTP access in AWS using Python, you can follow the steps below:

        1. Create a Python script to check for SMTP access:

        ```python theme={null}
        import boto3

        client = boto3.client('ec2')
        response = client.describe_security_groups()

        for group in response['SecurityGroups']:
            for permission in group['IpPermissions']:
                if permission.get('FromPort') == 25 and permission.get('IpRanges') == [{'CidrIp': '0.0.0.0/0'}]:
                    group_id = group['GroupId']
                    print(f"Found unrestricted SMTP access in security group {group_id}")
        ```

        2. Once you have identified the security group(s) with unrestricted SMTP access, you can update the security group rules to restrict SMTP access to specific IP addresses or ranges.

        ```python theme={null}
        import boto3

        client = boto3.client('ec2')
        response = client.authorize_security_group_ingress(
            GroupId='SECURITY_GROUP_ID',
            IpPermissions=[
                {
                    'IpProtocol': 'tcp',
                    'FromPort': 25,
                    'ToPort': 25,
                    'IpRanges': [
                        {
                            'CidrIp': 'ALLOWED_IP_ADDRESS/32'
                        }
                    ]
                }
            ]
        )
        ```

        Replace `SECURITY_GROUP_ID` with the ID of the security group that needs to be updated and `ALLOWED_IP_ADDRESS` with the IP address or range that should be allowed to access SMTP.

        3. Run the Python script to check for and remediate unrestricted SMTP access in AWS.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_security_group" "smtp_sg" {
          name        = "smtp-sg"
          description = "Security group without unrestricted SMTP"
          vpc_id      = VPC_ID  # replace with your VPC ID
        }

        # OPTIONAL: if SMTP is still required, add a *restricted* rule (example IPv4)
        resource "aws_vpc_security_group_ingress_rule" "smtp_ipv4_restricted" {
          security_group_id = aws_security_group.smtp_sg.id

          ip_protocol = "tcp"
          from_port   = 25
          to_port     = 25

          cidr_ipv4   = "ALLOWED_IPV4_CIDR" # replace with a specific CIDR, NOT 0.0.0.0/0
        }

        # OPTIONAL: if SMTP is required over IPv6, add a *restricted* rule (example IPv6)
        resource "aws_vpc_security_group_ingress_rule" "smtp_ipv6_restricted" {
          security_group_id = aws_security_group.smtp_sg.id

          ip_protocol = "tcp"
          from_port   = 25
          to_port     = 25

          cidr_ipv6   = "ALLOWED_IPV6_CIDR" # replace with a specific CIDR, NOT ::/0
        }
        ```

        To apply the verified CLI remediation in Terraform, ensure there is **no** `aws_vpc_security_group_ingress_rule` (or inline `ingress` block, if you still use it) on this security group with:

        * `ip_protocol = "tcp"`, `from_port = 25`, `to_port = 25`
        * and `cidr_ipv4 = "0.0.0.0/0"` (unrestricted IPv4) or `cidr_ipv6 = "::/0"` (unrestricted IPv6).

        Delete those rule resources (or change their CIDRs to specific ranges as in the example). This permanently removes unrestricted SMTP ingress; if you had clients relying on open SMTP, their access will stop until you add more restrictive rules.

        This change does not replace the security group itself, but `terraform plan` should show the offending ingress rule(s) being destroyed (or updated from `0.0.0.0/0` / `::/0` to the new restricted CIDR).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>