MQ Broker Should Not Be Publicly Accessible
More Info:
MQ brokers should not be launched into public cloud. Unless there is a specific business requirement, MQ Brokers should not have a public endpoint and should be accessed from within a VPC only.Risk Level
MediumAddress
SecurityCompliance Standards
GDPR, HITRUST, SOC2Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of an MQ Broker being publicly accessible in AWS Security Groups, follow these steps using the AWS Management Console:
- Log in to the AWS Management Console: Go to https://aws.amazon.com/ and log in to your AWS account.
- Navigate to the Amazon MQ Service: Click on the “Services” dropdown menu at the top left corner of the console, then select “Amazon MQ” under the “Messaging” category.
- Select the MQ Broker: In the Amazon MQ dashboard, select the MQ Broker that is publicly accessible.
-
Update Security Group Rules:
- In the left-hand navigation pane, click on “Configuration” and then select the “Security groups” tab.
- Click on the security group that is associated with the MQ Broker.
-
Edit Inbound Rules:
- In the “Inbound rules” tab, review the existing rules that allow public access to the MQ Broker.
- Identify the rule(s) that allow access from any IP address (0.0.0.0/0) or from unauthorized IP ranges.
-
Remove Public Access:
- Select the rule(s) that allow public access to the MQ Broker.
- Click on the “Actions” dropdown menu and choose “Edit inbound rules”.
- Remove the rule(s) that allow access from any IP address or unauthorized IP ranges.
- Add specific IP ranges or security groups that are allowed to access the MQ Broker if necessary.
- Save Changes: Click on the “Save rules” button to apply the changes to the security group.
-
Verify Changes:
- Go back to the Amazon MQ dashboard and check the security group settings for the MQ Broker to ensure that public access has been restricted.
- Test the connectivity to the MQ Broker to ensure that it is only accessible from authorized sources.
Using CLI
Using CLI
To remediate the misconfiguration of making an MQ Broker publicly accessible in AWS using AWS CLI, you can follow these steps:
- List the existing security groups associated with your MQ Broker:
- Identify the security group associated with the MQ Broker that is publicly accessible:
- Note down the Security Group ID associated with the MQ Broker.
-
Update the inbound rules of the Security Group to restrict access only to the necessary IP addresses or CIDR blocks. Replace
<security-group-id>with the Security Group ID noted in step 3 and<your-ip>with your IP address:
- Verify that the inbound rule has been updated successfully:
- Repeat steps 4 and 5 for any other necessary ports (e.g., 61614 for AMQP, 5671 for MQTT, etc.) to ensure that only the required ports are accessible.
Using Python
Using Python
To remediate the misconfiguration of an MQ Broker being publicly accessible in AWS using Python, you can follow these steps:Make sure to replace
- Identify the Security Group: First, you need to identify the Security Group associated with the MQ Broker.
- Update Security Group Rules: You will need to update the inbound rules of the Security Group to restrict access to the MQ Broker to only the necessary IP addresses or ranges.
- Revoke Public Access: Remove the existing rule that allows public access to the MQ Broker.
'your_region' and 'your_security_group_id' with the appropriate values for your environment.After running this script, the Security Group associated with the MQ Broker will be updated to revoke public access, thereby remedying the misconfiguration of the MQ Broker being publicly accessible in AWS.