> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ec2 instances exist with default groups and public remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of the default security group being publicly accessible in AWS, follow these steps using the AWS Management Console: 1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to your AWS account. 2. **Navigate to the EC2 Dashboard**: Click on the "Services" dropdown menu at the top left corner of the console, select "EC2" under the Compute section. 3. **Access the Security Groups**: In the EC2 Dashboard, locate and click on the "Security Groups" option in the left-hand navigation pane. 4. **Identify the Default Security Group**: Look for the default security group in the list of security groups. The default security group has the name "default" and is associated with all new instances that are launched in the VPC. 5. **Edit Inbound Rules**: Click on the default security group to select it, and then navigate to the "Inbound Rules" tab at the bottom of the console. 6. **Remove Publicly Accessible Rules**: Identify any inbound rules that allow unrestricted access from the internet (0.0.0.0/0 or ::/0) and remove them. This includes rules allowing SSH (port 22), RDP (port 3389), HTTP (port 80), HTTPS (port 443), etc. 7. **Add Necessary Rules**: Add specific inbound rules that allow access only from trusted sources, such as your organization's IP addresses or specific security groups within your VPC. 8. **Save the Changes**: After making the necessary changes to the inbound rules, click on the "Save rules" button to apply the changes to the default security group. 9. **Verify Changes**: Double-check the inbound rules to ensure that only necessary and restricted access is allowed to the default security group. By following these steps, you can remediate the misconfiguration of the default security group being publicly accessible in AWS and enhance the security of your cloud environment. # To remediate the misconfiguration of the default security group being publicly accessible in AWS, you can follow these steps using the AWS CLI: 1. List all the security groups in your AWS account to identify the default security group: ``` aws ec2 describe-security-groups --query "SecurityGroups[?GroupName=='default']" ``` 2. Get the Group ID of the default security group from the output of the above command. 3. Update the inbound rules of the default security group to restrict access. You can remove the existing rules or update them to allow access only from specific IP ranges or security groups. For example, to remove all inbound rules from the default security group: ``` aws ec2 revoke-security-group-ingress --group-id --protocol -1 --source-group all ``` 4. Verify that the inbound rules have been updated successfully by describing the security group: ``` aws ec2 describe-security-groups --group-ids ``` By following these steps, you can ensure that the default security group in your AWS account is no longer publicly accessible. To remediate the misconfiguration of the default security group being publicly accessible in AWS using Python, you can follow these steps: 1. Use the AWS SDK for Python (Boto3) to programmatically update the inbound rules of the default security group to restrict access. 2. Here's a sample Python script that demonstrates how to update the default security group to allow only specific IP ranges or ports: ```python theme={null} import boto3 # Initialize the EC2 client ec2 = boto3.client('ec2') # Get the default security group ID response = ec2.describe_security_groups(GroupNames=['default']) default_security_group_id = response['SecurityGroups'][0]['GroupId'] # Revoke existing inbound rules that allow all traffic ec2.revoke_security_group_ingress( GroupId=default_security_group_id, IpPermissions=[ { 'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}] } ] ) # Add new inbound rules to allow specific IP ranges or ports ec2.authorize_security_group_ingress( GroupId=default_security_group_id, IpPermissions=[ { 'IpProtocol': 'tcp', 'FromPort': 22, 'ToPort': 22, 'IpRanges': [{'CidrIp': 'YOUR_IP_RANGE'}] }, { 'IpProtocol': 'tcp', 'FromPort': 80, 'ToPort': 80, 'IpRanges': [{'CidrIp': 'YOUR_IP_RANGE'}] } ] ) print('Default security group remediated successfully.') ``` 3. Replace `'YOUR_IP_RANGE'` with the specific IP range or port that you want to allow access to. You can add multiple rules as needed. 4. Run this Python script in your AWS environment with the necessary IAM permissions to update security groups. By following these steps, you can remediate the misconfiguration of the default security group being publicly accessible in AWS using Python. ```hcl theme={null} # Manage the VPC's default security group and remove all public ingress resource "aws_default_security_group" "default" { vpc_id = aws_vpc.MY_VPC.id # Replace aws_vpc.MY_VPC with your VPC resource or the ID of the VPC # WARNING: Modifying the default security group affects ALL resources using it. # Best practice (and what this rule wants): no ingress rules at all on the default SG. # So we do NOT define any ingress block here. # Optionally keep default egress or restrict it as needed egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] # For IPv6, if used: # ipv6_cidr_blocks = ["::/0"] } tags = { Name = "default-${aws_vpc.MY_VPC.id}" # Optional: change as needed } } ``` This exactly matches the CLI intent by revoking public ingress on the default security group (here by declaring *no* ingress rules at all); it is an in-place update, not a replacement, but will immediately impact connectivity for any instance still using this default group. To verify, `terraform plan` should show the `aws_default_security_group.default` resource having all existing `ingress` rules removed (or changed so that no rule has `cidr_blocks = ["0.0.0.0/0"]` or `ipv6_cidr_blocks = ["::/0"]`) with the resource marked for `update in-place`.