Skip to main content

Default Security Groups Should Block All Traffic

More Info:​

Default security groups should block all traffic by default. EC2 instances should not be associated with default security groups.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of default security groups allowing all traffic in AWS, follow these steps using the AWS Management Console:

  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in with your credentials.

  2. Navigate to the EC2 Dashboard: Click on the "Services" dropdown in the top left corner and select "EC2" under the Compute section.

  3. Access Security Groups: In the EC2 Dashboard, locate and click on the "Security Groups" option in the left-hand navigation pane.

  4. Identify Default Security Group: Look for the default security group in the list of security groups. The default security group usually has the Group Name as "default" and the description as "default VPC security group".

  5. Edit Inbound Rules: Click on the default security group to select it. Then, navigate to the "Inbound rules" tab at the bottom of the dashboard.

  6. Remove All Inbound Rules: You will see a list of inbound rules that allow traffic to the instances associated with this security group. To block all traffic, you need to remove all existing inbound rules.

  7. Add Necessary Rules: After removing all inbound rules, you can add specific rules based on your requirements. Click on the "Edit inbound rules" button and add rules for the specific ports and protocols that your instances need to communicate with.

  8. Save Changes: Once you have added the necessary rules, click on the "Save rules" button to apply the changes to the default security group.

  9. Verify Changes: Verify that the default security group now only allows traffic based on the rules you have defined.

By following these steps, you have successfully remediated the misconfiguration of default security groups allowing all traffic in AWS.

Using CLI

To remediate the misconfiguration of default security groups allowing all traffic in AWS using AWS CLI, follow these steps:

  1. List all default security groups in your AWS account:
aws ec2 describe-security-groups --filters Name=group-name,Values=default

  1. Identify the default security group that allows all traffic.

  2. Get the Group ID of the default security group that allows all traffic:

aws ec2 describe-security-groups --group-names default --query 'SecurityGroups[0].GroupId' --output text
  1. Update the inbound rules of the default security group to deny all traffic:
aws ec2 revoke-security-group-ingress --group-id YOUR_GROUP_ID --protocol all --port all --cidr 0.0.0.0/0
  1. Update the outbound rules of the default security group to deny all traffic:
aws ec2 revoke-security-group-egress --group-id YOUR_GROUP_ID --protocol all --port all --cidr 0.0.0.0/0

Replace YOUR_GROUP_ID with the Group ID of the default security group that allows all traffic.

By following these steps, you will successfully remediate the misconfiguration of default security groups allowing all traffic in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of default security groups allowing all traffic in AWS using Python, you can use the AWS SDK for Python (Boto3) to update the inbound and outbound rules of the default security group to deny all traffic. Here are the step-by-step instructions to remediate this issue:

  1. Install Boto3: If you haven't already installed Boto3, you can do so using pip:
pip install boto3
  1. Write a Python script to update the default security group:
import boto3

# Initialize the EC2 client
ec2 = boto3.client('ec2')

# Get the default security group ID
response = ec2.describe_security_groups(Filters=[{'Name': 'group-name', 'Values': ['default']}])
default_security_group_id = response['SecurityGroups'][0]['GroupId']

# Revoke all inbound rules
ec2.revoke_security_group_ingress(
    GroupId=default_security_group_id,
    IpPermissions=[{'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}]
)

# Revoke all outbound rules
ec2.revoke_security_group_egress(
    GroupId=default_security_group_id,
    IpPermissions=[{'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}]
)

print("Default security group rules updated to deny all traffic.")
  1. Run the Python script: Execute the Python script to update the default security group rules to deny all traffic.
python update_default_security_group.py

After running this script, the default security group in your AWS account will be updated to block all inbound and outbound traffic. Make sure to review the changes and ensure they align with your security requirements.

Using Terraform
resource "aws_security_group" "NEW_INSTANCE_SG" {
  name        = "sg-for-INSTANCE_NAME" # replace with a descriptive name for this instance
  description = "Dedicated security group for instance INSTANCE_NAME"
  vpc_id      = aws_vpc.TARGET_VPC.id  # replace with the VPC this instance is in (or a data source)

  # Example: allow SSH only from your IP; adjust protocol/port/CIDR for your application needs
  ingress {
    description = "SSH from admin IP"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["YOUR_IP_ADDRESS/32"] # replace with your admin IP or appropriate CIDR
  }

  # Default: allow all egress; tighten if required
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = []
  }

  tags = {
    Name = "sg-for-INSTANCE_NAME"
  }
}

resource "aws_instance" "THIS_INSTANCE" {
  ami                    = "AMI_ID"      # replace with the desired AMI
  instance_type          = "t3.micro"    # replace as needed
  subnet_id              = aws_subnet.TARGET_SUBNET.id # same subnet/VPC as before
  # ... other required arguments ...

  # IMPORTANT: This list REPLACES all existing security group associations.
  # Include ALL desired non-default security groups here.
  vpc_security_group_ids = [
    aws_security_group.NEW_INSTANCE_SG.id,
    "OTHER_NON_DEFAULT_SG_ID_1", # replace with any additional non-default SGs to keep, or remove if none
    "OTHER_NON_DEFAULT_SG_ID_2",
  ]

  tags = {
    Name = "INSTANCE_NAME" # replace with your instance name
  }
}

Changing vpc_security_group_ids is an in-place update of the instance (no replacement), but it is destructive in the sense that the list is fully replaced—ensure all required non-default security groups are included.

To verify, terraform plan should show:

  • + creation of aws_security_group.NEW_INSTANCE_SG
  • ~ update to aws_instance.THIS_INSTANCE with the old security group IDs replaced by the new list containing aws_security_group.NEW_INSTANCE_SG.id and any other non-default groups you keep.

Additional Reading:​