cis-aws-foundations-6.4

Ensure no security groups allow ingress from ::/0 to remote server administration ports

Description

Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port 22 and RDP on port 3389, using either the TCP (6), UDP (17), or ALL (-1) protocols.

Rationale

Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases attack surface of resources and unnecessarily raises the risk of resource compromise.

Impact

When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the ::/0 inbound rule.

Audit Procedure

Using AWS Console

1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
2. In the left pane, click Security Groups.
3. For each security group, perform the following:
   • Select the security group.
   • Click the Inbound Rules tab.
   • Ensure that no rule exists which has a port range including port 22, 3389, or other remote server administration ports for your environment, and has a Source of ::/0.

Note:

• A port value of ALL or a port range such as 0-3389 includes port 22, 3389, and potentially other remote server administration ports.
• Security groups are stateful and do not support explicit DENY rules. Therefore, an "effective ruleset" approach (e.g., allowing ANY/ANY but denying specific ports) is not applicable. Any rule that allows ::/0 access to administrative ports is considered non-compliant and must be removed or restricted.

Using AWS CLI

1. Check all security groups for insecure inbound rules that allow traffic from ::/0:

aws ec2 describe-security-group-rules --query 'SecurityGroupRules[?CidrIpv6 == `::/0` && IsEgress == `false`]' --output json

Expected Result

No security group should have inbound rules allowing traffic from ::/0 to port 22 or 3389.

Remediation

Using AWS Console

1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
2. In the left pane, click Security Groups.
3. For each security group, perform the following:
   • Select the security group.
   • Click the Inbound Rules tab.
   • Click the Edit inbound rules button.
   • Identify the rules to be edited or removed.
   • Either A) update the Source field to a range other than ::/0, or B) Click Delete to remove the offending inbound rule.
   • Click Save rules.

Using AWS CLI

1. Check all security groups for insecure inbound rules that allow traffic from ::/0:

aws ec2 describe-security-group-rules --query 'SecurityGroupRules[?CidrIpv6 == `::/0` && IsEgress == `false`]' --output json

2. Delete the insecure rule(s) based on the rule ID:

aws ec2 delete-security-group-rules --group-id <security_group_id> --security-group-rule-ids <rule_id_to_delete>

3. Recreate necessary security group rules:

aws ec2 authorize-security-group-ingress --group-id <security_group_id> --protocol <tcp, udp, icmp or all> --port <port_number> --cidr <source_cidr>

Default Value

By default, security groups may allow unrestricted IPv6 ingress (::/0) on ports like SSH (22) or RDP (3389). AWS does not block this automatically; restrictions must be applied manually.

References

1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated