Skip to main content

EC2 Instance Should Not Have Open ICMP ports

More Info:​

ICMP ports should not be open for EC2 instances.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of an EC2 instance having open ICMP ports in AWS Security Groups, follow these steps using the AWS Management Console:

  1. Sign in to the AWS Management Console.
  2. Navigate to the EC2 dashboard.
  3. In the navigation pane, choose "Security Groups."
  4. Select the security group associated with the EC2 instance that has open ICMP ports.
  5. In the "Inbound rules" tab, locate the rule that allows ICMP traffic (Protocol: ICMP) with any source (0.0.0.0/0 or ::/0).
  6. Select the rule by checking the box next to it.
  7. Click on the "Actions" dropdown menu and choose "Edit inbound rules."
  8. In the Edit inbound rules dialog box, locate the ICMP rule and click on the "X" icon to remove it.
  9. Click the "Save rules" button to apply the changes.

By following these steps, you have remediated the misconfiguration of the EC2 instance having open ICMP ports in the AWS Security Group. Now, the instance will no longer allow ICMP traffic from any source.

Using CLI

To remediate the open ICMP ports on an EC2 instance in AWS using AWS CLI, you can follow these steps:

  1. Identify the Security Group associated with the EC2 instance that has the open ICMP ports:

    Run the following AWS CLI command to describe the security groups associated with the EC2 instance:

    aws ec2 describe-instances --instance-ids <instance-id> --query 'Reservations[*].Instances[*].SecurityGroups[*].[GroupId]' --output text

    Replace <instance-id> with the actual ID of the EC2 instance.

  2. Identify the inbound rules in the Security Group that allow ICMP traffic:

    Run the following AWS CLI command to describe the inbound rules of the Security Group:

    aws ec2 describe-security-groups --group-ids <security-group-id> --query 'SecurityGroups[*].IpPermissions[]'

    Replace <security-group-id> with the Security Group ID obtained in the previous step.

  3. Revoke the inbound rule that allows ICMP traffic:

    Run the following AWS CLI command to revoke the inbound rule that allows ICMP traffic (replace the actual values for Protocol, Port Range, and CIDR IP based on the output from the previous step):

    aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol icmp --port <port-range> --cidr <cidr-ip>

  4. Verify that the inbound rule allowing ICMP traffic has been revoked:

    Run the following AWS CLI command to describe the inbound rules of the Security Group again and verify that the rule allowing ICMP traffic is no longer present:

    aws ec2 describe-security-groups --group-ids <security-group-id> --query 'SecurityGroups[*].IpPermissions[]'

By following these steps, you can successfully remediate the open ICMP ports on an EC2 instance in AWS by using AWS CLI.

Using Python

To remediate the misconfiguration of an EC2 instance having open ICMP ports in AWS Security Groups using Python, you can follow these steps:

  1. Install the Boto3 library using pip if you haven't already:
pip install boto3
  1. Use the following Python script to identify and revoke the ingress rule that allows ICMP traffic in the specified security group:
import boto3

# Initialize the EC2 client
ec2 = boto3.client('ec2')

# Specify the security group ID that needs to be remediated
security_group_id = 'YOUR_SECURITY_GROUP_ID'

# Describe the security group to get the current ingress rules
response = ec2.describe_security_groups(GroupIds=[security_group_id])
ingress_rules = response['SecurityGroups'][0]['IpPermissions']

# Revoke any ingress rule that allows ICMP traffic
for rule in ingress_rules:
    if 'IpProtocol' in rule and rule['IpProtocol'] == 'icmp':
        ec2.revoke_security_group_ingress(
            GroupId=security_group_id,
            IpPermissions=[rule]
        )
        print(f"Revoked ICMP rule in security group: {security_group_id}")

  1. Replace 'YOUR_SECURITY_GROUP_ID' with the actual ID of the security group that needs to be remediated.

  2. Run the Python script, and it will revoke any ingress rule that allows ICMP traffic in the specified security group.

By following these steps, you can remediate the misconfiguration of an EC2 instance having open ICMP ports in AWS Security Groups using Python.

Using Terraform
# Security group attached to the EC2 instance
resource "aws_security_group" "INSTANCE_SG" {
  name        = "INSTANCE_SG_NAME"          # replace with your SG name
  description = "Security group for EC2 instance"
  vpc_id      = "VPC_ID"                    # replace with your VPC ID
}

# REMOVE any existing rules like this (icmp from 0.0.0.0/0) from your Terraform:
# resource "aws_vpc_security_group_ingress_rule" "icmp_ipv4_open" {
#   security_group_id = aws_security_group.INSTANCE_SG.id
#   ip_protocol       = "icmp"
#   from_port         = -1
#   to_port           = -1
#   cidr_ipv4         = "0.0.0.0/0"
# }

# REMOVE any existing rules like this (icmpv6 from ::/0) from your Terraform:
# resource "aws_vpc_security_group_ingress_rule" "icmp_ipv6_open" {
#   security_group_id = aws_security_group.INSTANCE_SG.id
#   ip_protocol       = "58"     # ICMPv6
#   from_port         = -1
#   to_port           = -1
#   cidr_ipv6         = "::/0"
# }

# Optionally, replace with a more restricted ICMPv4 rule (example: from a monitoring subnet)
resource "aws_vpc_security_group_ingress_rule" "icmp_ipv4_restricted" {
  security_group_id = aws_security_group.INSTANCE_SG.id
  ip_protocol       = "icmp"
  from_port         = -1
  to_port           = -1
  cidr_ipv4         = "MONITORING_SUBNET_CIDR" # e.g. "10.0.10.0/24"
}

# Optionally, replace with a more restricted ICMPv6 rule
resource "aws_vpc_security_group_ingress_rule" "icmp_ipv6_restricted" {
  security_group_id = aws_security_group.INSTANCE_SG.id
  ip_protocol       = "58"      # ICMPv6
  from_port         = -1
  to_port           = -1
  cidr_ipv6         = "ALLOWED_IPV6_CIDR"      # e.g. "2001:db8:1234::/64"
}

Removing or changing these aws_vpc_security_group_ingress_rule resources forces replacement of the individual security group rules, but not the security group or the instance itself. This change affects all resources using INSTANCE_SG_NAME, not just the single EC2 instance.

To verify, terraform plan should show the ingress rules that allowed ICMP from 0.0.0.0/0 and ::/0 being destroyed (and, if you added them, the restricted rules being created).

Additional Reading:​