Skip to main content

Excessive Number of Security Groups Should Not Be Present

More Info:​

There should not be an excessive number of security groups in the account. AWS applies the most permissive rule amongst all the Security Groups assigned to any EC2 instance.

Risk Level​

Informational

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of having an excessive number of security groups in AWS, you can follow these steps using the AWS Management Console:

  1. Identify Unused Security Groups:

    • Go to the AWS Management Console and navigate to the EC2 dashboard.
    • Click on the 'Security Groups' option in the left-hand menu to view all the security groups in your account.
    • Review each security group and identify the ones that are not associated with any EC2 instances or other resources.

  2. Remove Unused Security Groups:

    • Select the unused security groups that you want to delete by checking the box next to each one.
    • Click on the 'Actions' dropdown menu at the top, and select 'Delete security group'.
    • Confirm the deletion when prompted.

  3. Update Security Group Rules:

    • Review the remaining security groups to ensure that they have the necessary and correct inbound and outbound rules.
    • Remove any unnecessary rules that are overly permissive or no longer needed.

  4. Consolidate Security Groups:

    • If you have multiple security groups with similar rules, consider consolidating them into fewer security groups to simplify management.
    • Update the security group associations for your resources to use the consolidated security groups.

  5. Implement Security Group Naming Conventions:

    • Establish a naming convention for your security groups to easily identify their purpose and associated resources.
    • Rename the security groups accordingly to maintain consistency and organization.

  6. Regularly Audit Security Groups:

    • Schedule periodic reviews of your security groups to identify and remove any unused or redundant ones.
    • Ensure that security groups are properly configured and adhere to your organization's security policies.

By following these steps, you can remediate the issue of having an excessive number of security groups in AWS and improve the security posture of your cloud environment.

Using CLI

To remediate the excessive number of security groups in AWS using AWS CLI, you can follow these steps:

  1. List all Security Groups: First, you need to list all the existing security groups in your AWS account to identify the excessive ones. You can use the following AWS CLI command to list all security groups:
aws ec2 describe-security-groups

  1. Identify Excessive Security Groups: Review the list of security groups returned by the above command and identify the ones that are not necessary or are excessive.

  2. Delete Excessive Security Groups: To delete a security group, you can use the following AWS CLI command:

aws ec2 delete-security-group --group-id YOUR_SECURITY_GROUP_ID

Replace YOUR_SECURITY_GROUP_ID with the actual ID of the security group you want to delete. Make sure to only delete the security groups that are not required and do not impact your existing resources.

  1. Repeat as Necessary: Repeat the above steps for each excessive security group that needs to be deleted.

  2. Monitor and Test: After deleting the excessive security groups, monitor your resources to ensure that the necessary security groups are in place and that the deletion of the excessive ones did not impact your applications or services.

By following these steps, you can remediate the issue of having an excessive number of security groups in your AWS account using AWS CLI.

Using Python

To remediate the excessive number of security groups in AWS using Python, you can use the Boto3 library, which is the AWS SDK for Python. Below are the step-by-step instructions to identify and clean up the excessive security groups:

  1. Install the Boto3 library:
pip install boto3
  1. Create a Python script (e.g., remediate_security_groups.py) with the following code:
import boto3

# Initialize the AWS clients for EC2
ec2_client = boto3.client('ec2')

def get_excessive_security_groups():
    # Get all security groups
    response = ec2_client.describe_security_groups()
    security_groups = response['SecurityGroups']
    
    # Filter security groups with more than 1 rule
    excessive_security_groups = [sg['GroupId'] for sg in security_groups if len(sg['IpPermissions']) > 1]
    
    return excessive_security_groups

def delete_security_group(group_id):
    # Delete the security group
    ec2_client.delete_security_group(GroupId=group_id)
    print(f"Security Group {group_id} deleted successfully")

if __name__ == '__main__':
    excessive_groups = get_excessive_security_groups()
    
    if excessive_groups:
        for group_id in excessive_groups:
            delete_security_group(group_id)
    else:
        print("No excessive security groups found")
  1. Run the Python script using the following command:
python remediate_security_groups.py

This script will identify security groups with more than one rule and delete them. Make sure you have the necessary permissions to delete security groups in your AWS account before running this script.

Using Terraform
# Consolidated security group with the combined least-privilege rules
resource "aws_security_group" "CONSOLIDATED_SG" {
  name        = "CONSOLIDATED_SG_NAME"   # replace with desired SG name
  description = "Consolidated security group for EC2 instance"
  vpc_id      = "VPC_ID"                 # replace with the VPC ID where the instance resides

  # Add only the required, consolidated rules from the existing security groups

  ingress {
    description = "REPLACE_WITH_RULE_DESCRIPTION"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["ALLOWED_CIDR_1", "ALLOWED_CIDR_2"] # replace with required CIDRs
  }

  # Add additional ingress/egress blocks as needed to cover all required access
}

# EC2 instance configured to use only the consolidated security group
resource "aws_instance" "EC2_INSTANCE" {
  ami                    = "AMI_ID"                 # replace with the AMI ID
  instance_type          = "INSTANCE_TYPE"          # replace with the instance type
  subnet_id              = "SUBNET_ID"              # replace with the subnet ID
  iam_instance_profile   = "INSTANCE_PROFILE_NAME"  # optional; replace/remove as needed

  # This argument mirrors:
  #   aws ec2 modify-instance-attribute --groups <space-separated-list-of-sg-ids>
  # and REPLACES all currently attached security groups.
  vpc_security_group_ids = [
    aws_security_group.CONSOLIDATED_SG.id,
    # If you are doing a staged migration, temporarily keep one or more
    # of the original SG IDs here in an earlier Terraform apply, then
    # remove them in a later change after testing.
    # "EXISTING_SG_ID_1",
    # "EXISTING_SG_ID_2",
  ]

  # ... other required arguments for your instance ...
}

This change does not force replacement of the EC2 instance; Terraform will update the vpc_security_group_ids in-place, which immediately replaces the effective set of security groups and can break connectivity if the consolidated rules are incomplete. The manual analysis and staged-attachment warnings from the CLI remediation still apply.

For verification, terraform plan should show:

  • A new aws_security_group.CONSOLIDATED_SG to be created (if it doesn’t already exist).
  • An in-place update to aws_instance.EC2_INSTANCE where vpc_security_group_ids changes from the previous list of many security groups to the new, consolidated list you specify.

Additional Reading:​