standard
turbot/aws_cis

Pipeline: 5.5 Ensure the default security group of every VPC restricts all traffic

Description

A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If a security group is not specified when an instance is launched, it is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic, both inbound and outbound.

The default VPC in every region should have its default security group updated to comply with the following:

  • No inbound rules.
  • No outbound rules.

Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation.

NOTE:When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly, as it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering by discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.

Configuring all VPC default security groups to restrict all traffic will encourage the development of least privilege security groups and promote the mindful placement of AWS resources into security groups, which will, in turn, reduce the exposure of those resources.

Remediation

Perform the following to implement the prescribed state: Security Group Members

  1. Identify AWS resources that exist within the default security group.
  2. Create a set of least-privilege security groups for those resources.
  3. Place the resources in those security groups, removing the resources noted in step 1 from the default security group.

Security Group State

  1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
  2. Repeat the following steps for all VPCs, including the default VPC in each AWS region:
  3. In the left pane, click Security Groups.
  4. For each default security group, perform the following:
  • Select the default security group.
  • Click the Inbound Rules tab.
  • Remove any inbound rules.
  • Click the Outbound Rules tab.
  • Remove any Outbound rules.

IAM groups allow you to edit the "name" field. After remediating default group rules for all VPCs in all regions, edit this field to add text similar to "DO NOT USE. DO NOT ADD RULES."

Run the pipeline

To run this pipeline from your terminal:

flowpipe pipeline run aws_cis.pipeline.cis_v400_5_5

Use this pipeline

To call this pipeline from your pipeline, use a step:

step "pipeline" "step_name" {
pipeline = aws_cis.pipeline.cis_v400_5_5
}

Params

NameTypeRequiredDescriptionDefault
database
connection.steampipe
YesDatabase connection string.connection.steampipe.default
notifier
notifier
YesThe name of the notifier to use for sending notification messages.notifier.default
notification_level
string
YesThe verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.info
approvers
list(notifier)
YesList of notifiers to be used for obtaining action/approval decisions.notifier.default

Outputs

This pipeline has no outputs.

Tags

folder = CIS v4.0.0/5 Networking