Ports Should Not Be Open for External Traffic
More Info:
Security groups should not have all ports or protocols open to the public. Security groups should be created on a per-service basis and avoid allowing all ports or protocols.Risk Level
MediumAddress
SecurityCompliance Standards
NISTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of ports being open for external traffic in AWS Security Groups, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console.
- Navigate to the EC2 dashboard.
- In the navigation pane, under the ‘Network & Security’ section, click on ‘Security Groups’.
- Select the security group that has the open ports for external traffic that you want to remediate.
- Click on the ‘Inbound rules’ tab.
- Identify the rule that allows external traffic (0.0.0.0/0) to access the specific port(s).
- Click on the ‘Edit inbound rules’ button.
- Select the rule that allows the unwanted external traffic and click on the ‘Delete’ button to remove it.
- Click on the ‘Save rules’ button to apply the changes.
- Verify that the rule allowing external traffic to the specific port(s) has been removed successfully.
Using CLI
Using CLI
To remediate the issue of ports being open for external traffic in AWS Security Groups using AWS CLI, follow these steps:
- Identify the security group that has the open port for external traffic. You can use the following AWS CLI command to list all security groups in your AWS account:
- Once you have identified the security group that needs to be remediated, note down the Group ID of the security group.
-
Use the following AWS CLI command to revoke the ingress rule that allows external traffic to the port in the security group. Replace
<group-id>and<ip-permission-id>with the actual values:
- Verify that the ingress rule has been revoked successfully by describing the security group again:
- Repeat the above steps for any other security groups that have open ports for external traffic.
Using Python
Using Python
To remediate the issue of ports being open for external traffic in AWS Security Groups using Python, you can use the AWS SDK for Python (Boto3) to update the security group rules. Here are the step-by-step instructions to remediate this issue:
- Install the Boto3 library if you haven’t already:
- Use the following Python script to identify and close the open ports in the security groups:
-
Replace
'YOUR_SECURITY_GROUP_ID'with the actual ID of the security group that you want to remediate. - Run the Python script. It will iterate over each inbound rule in the specified security group and revoke the open ports for external traffic.