standard
turbot/aws_compliance
- Detect & correct accounts without alternate security contact
- Detect & correct accounts without metric filter for bucket policy changes
- Detect & correct accounts without metric filter for CloudTrail configuration
- Detect & correct accounts without metric filter for Config configuration
- Detect & correct accounts without metric filter for console authentication failure
- Detect & correct accounts without metric filter for console login MFA changes
- Detect & correct accounts without metric filter for disable or delete CMK
- Detect & correct accounts without metric filter for IAM policy changes
- Detect & correct accounts without metric filter for network ACL changes
- Detect & correct CloudWatch log groups without metric filter for network gateway changes
- Detect & correct CloudWatch log groups without metric filter for organization changes
- Detect & correct accounts without metric filter for root login
- Detect & correct accounts without metric filter for route table changes
- Detect & correct accounts without metric filter for security group changes
- Detect & correct accounts without metric filter for unauthorized API changes
- Detect & correct accounts without metric filter for VPC changes
- Detect & correct API Gateway rest API stages with x-ray tracing disabled
- Detect & correct CloudTrail Trail logs not encrypted with KMS CMK
- Detect & correct CloudTrail trails with log file validation disabled
- Detect & correct CloudTrail trails with multi-region read/write disabled
- Detect & correct CloudTrail trails using public S3 bucket
- Detect & correct CloudTrail trails with S3 logging disabled
- Detect & correct CloudTrail trails with S3 object level logging for read events disabled
- Detect & correct CloudTrail trails with S3 object level logging for write events disabled
- Detect & correct Config disabled in regions
- Detect & correct DynamoDB table with deletion protection disabled
- Detect & correct DynamoDB table with point-in-time recovery disabled
- Detect & correct EBS encryption by default disabled in regions
- Detect & correct EBS snapshots when publicly restorable
- Detect & correct EC2 classic load balancers with connection draining disabled
- Detect & correct EC2 instances with IMDSv1 enabled
- Detect & correct EC2 instances with multiple ENIs
- Detect & correct EC2 instances with public access enabled
- Detect & correct EFS file systems with encryption at rest disabled
- Detect & correct regions with IAM Access Analyzer disabled
- Detect & correct IAM account password policies without maximum password age of 90 days
- Detect & correct IAM account password policies without minimum length of 14
- Detect & correct IAM account password policies without requirement for any lowercase letter
- Detect & correct IAM account password policies without requirement for any number
- Detect & correct IAM account password policies without requirement for any symbol
- Detect & correct IAM account password policies without requirement for any uppercase letter
- Detect & correct IAM account password policies without password reuse 24
- Detect & correct IAM accounts without support role
- Detect & correct IAM groups attached with *:* policy
- Detect & correct IAM groups with unrestricted CloudShellFullAccess policy
- Detect & correct IAM roles attached with *:* policy
- Detect & correct IAM roles with unrestricted CloudShellFullAccess policy
- Detect & correct IAM root users last used in 90 days or more
- Detect & correct IAM root users with access keys
- Detect & correct IAM root users with hardware MFA disabled
- Detect & correct IAM root users with MFA disabled
- Detect & correct expired IAM server certificates
- Detect & correct IAM users with unused access key from 90 days or more
- Detect & correct IAM users with access key created during initial user setup
- Detect & correct IAM users with console access MFA disabled
- Detect & correct IAM users with IAM policy attached
- Detect & correct IAM users with inline policy
- Detect & correct IAM users with more than one active key
- Detect & correct IAM users attached with *:* policy
- Detect & correct IAM users with unrestricted CloudShellFullAccess policy
- Detect & correct IAM users with unused access key from 45 days or more
- Detect & correct IAM users with unused access key from 90 days or more
- Detect & correct IAM users with unused login profile from 45 days or more
- Detect & correct IAM users with unused login profile from 90 days or more
- Detect & correct KMS keys with rotation disabled
- Detect & correct RDS DB instances with auto minor version upgrade disabled
- Detect & correct RDS DB instances with encryption at rest disabled
- Detect & correct RDS DB instances with Multi-AZ disabled
- Detect & correct RDS DB instances with public access enabled
- Detect & correct S3 buckets with block public access disabled
- Detect & correct S3 buckets with default encryption disabled
- Detect & correct S3 buckets with Macie disabled
- Detect & correct S3 buckets with MFA delete disabled
- Detect & correct S3 buckets without SSL enforcement
- Detect & correct Security Hub disabled in regions
- Detect & correct default VPC security groups allowing ingress egress
- Detect & correct VPC network ACLs allowing ingress to remote server administration ports
- Detect & correct VPC Security groups allowing ingress to port 22
- Detect & correct VPC security groups allowing ingress to port 3389
- Detect & correct VPC security groups allowing ingress to port 445
- Detect & correct VPC Security groups allowing ingress to remote server administration ports
- Detect & correct VPC Security groups allowing ingress to remote server administration ports IPv4
- Detect & correct VPC Security groups allowing ingress to remote server administration ports IPv6
- Detect & correct VPCs without flow logs
Get Involved
Version
Trigger: Detect & correct VPC Security groups allowing ingress to remote server administration ports IPv4
Detect VPC Security group rules that allow ingress from 0.0.0.0/0 or ::/0 to remote server administration ports IPv4 and then skip or revoke the security security group rules.
Query
with bad_rules as ( select group_id, security_group_rule_id, ip_protocol, from_port, to_port, coalesce(cidr_ipv4 :: text, '') as cidr_ipv4, coalesce(cidr_ipv6 :: text, '') as cidr_ipv6, region, account_id, sp_connection_name as conn from aws_vpc_security_group_rule where type = 'ingress' and (cidr_ipv4 = '0.0.0.0/0') and ( ( ip_protocol = '-1' -- all traffic and from_port is null ) or ( from_port <= 22 and to_port >= 22 ) or ( from_port <= 3389 and to_port >= 3389 ) )),security_groups as ( select arn, region, account_id, group_id, sp_connection_name from aws_vpc_security_group order by group_id)select concat(sg.group_id, ' [', sg.account_id, '/', sg.region, ']') as title, sg.group_id as group_id, bad_rules.security_group_rule_id as security_group_rule_id, bad_rules.ip_protocol as ip_protocol, bad_rules.from_port as from_port, bad_rules.to_port as to_port, bad_rules.cidr_ipv4 as cidr_ipv4, bad_rules.cidr_ipv6 as cidr_ipv6, sg.region as region, sg.sp_connection_name as connfrom security_groups as sg left join bad_rules on bad_rules.group_id = sg.group_idwhere bad_rules.group_id is not null;
Schedule
15m
Tags
category = Compliance
mod = aws
service = AWS/VPC