Cis AWS Storage 3.5
DevOps & Securitycis-aws-storage-3.5Cis AWS Storage 3.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure using Security Groups for VPC to control EFS traffic
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Storage_Services_Benchmark_v1.0.0/cis-aws-storage-3.5/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-storage-3-5, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
3.5 Ensure using Security Groups for VPC (Manual)
Profile Applicability
- Level 2
Description
A security group controls the traffic that is allowed to reach and leave the resources that it is associated with. For example, after you associate a security group with an EC2 instance, it controls the inbound and outbound traffic for the instance.
Rationale
Security groups act as virtual firewalls to control network traffic to EFS mount targets, ensuring only authorized traffic can access the file system.
Impact
Without properly configured security groups, EFS mount targets may be exposed to unauthorized network access, potentially leading to data breaches or service disruptions.
Audit Procedure
Console
- Go to https://console.aws.amazon.com/vpc/
- Navigate to Security Groups and select on the VPC that houses your mount target.
- Ensure that incoming traffic is restricted to SSH access on port 22 using TCP protocol and outbound traffic is accepting all traffic.
Expected Result
- Security Groups should be configured to allow only necessary inbound traffic (e.g., SSH on port 22)
- Outbound traffic rules should be appropriately configured
- Security Groups should follow least privilege principle
Remediation
Console
Configure security groups to restrict traffic appropriately:
- Navigate to VPC console
- Select Security Groups
- Configure inbound rules to allow only necessary traffic (e.g., SSH on port 22 using TCP)
- Configure outbound rules as needed
- Apply security groups to EFS mount targets
Default Value
By default, the default security group for a VPC allows all inbound traffic from instances assigned to the same security group and all outbound traffic. Custom security groups must be explicitly configured for EFS mount targets.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.7 Centralize Access ControlCentralize access control for all enterprise assets through a directory service or SSO provider, where supported. | ● | ● | |
| v8 | 13.9 Deploy Port-Level Access ControlDeploy port-level access control. Port-level access control utilizes 802.1x, or similar network access control protocols, such as certificates, and may incorporate user and/or device authentication. | ● | ||
| v7 | 1.7 Deploy Port Level Access ControlUtilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network. | ● | ● |
Profile
Level 2