> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ports Should Not Be Open for External Traffic ### More Info: Security groups should not have all ports or protocols open to the public. Security groups should be created on a per-service basis and avoid allowing all ports or protocols. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the issue of ports being open for external traffic in AWS Security Groups, follow these steps using the AWS Management Console: 1. Sign in to the AWS Management Console. 2. Navigate to the EC2 dashboard. 3. In the navigation pane, under the 'Network & Security' section, click on 'Security Groups'. 4. Select the security group that has the open ports for external traffic that you want to remediate. 5. Click on the 'Inbound rules' tab. 6. Identify the rule that allows external traffic (0.0.0.0/0) to access the specific port(s). 7. Click on the 'Edit inbound rules' button. 8. Select the rule that allows the unwanted external traffic and click on the 'Delete' button to remove it. 9. Click on the 'Save rules' button to apply the changes. 10. Verify that the rule allowing external traffic to the specific port(s) has been removed successfully. By following these steps, you have successfully remediated the issue of ports being open for external traffic in the AWS Security Group. # To remediate the issue of ports being open for external traffic in AWS Security Groups using AWS CLI, follow these steps: 1. Identify the security group that has the open port for external traffic. You can use the following AWS CLI command to list all security groups in your AWS account: ``` aws ec2 describe-security-groups ``` 2. Once you have identified the security group that needs to be remediated, note down the Group ID of the security group. 3. Use the following AWS CLI command to revoke the ingress rule that allows external traffic to the port in the security group. Replace `` and `` with the actual values: ``` aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{"IpProtocol": "tcp", "FromPort": , "ToPort": , "IpRanges": [{"CidrIp": "0.0.0.0/0"}], "IpPermissionId": ""}]' ``` 4. Verify that the ingress rule has been revoked successfully by describing the security group again: ``` aws ec2 describe-security-groups --group-ids ``` 5. Repeat the above steps for any other security groups that have open ports for external traffic. By following the above steps, you can successfully remediate the issue of ports being open for external traffic in AWS Security Groups using AWS CLI. To remediate the issue of ports being open for external traffic in AWS Security Groups using Python, you can use the AWS SDK for Python (Boto3) to update the security group rules. Here are the step-by-step instructions to remediate this issue: 1. Install the Boto3 library if you haven't already: ```bash theme={null} pip install boto3 ``` 2. Use the following Python script to identify and close the open ports in the security groups: ```python theme={null} import boto3 # Initialize the EC2 client ec2 = boto3.client('ec2') # Define the security group ID that you want to remediate security_group_id = 'YOUR_SECURITY_GROUP_ID' # Describe the current inbound rules of the security group response = ec2.describe_security_groups(GroupIds=[security_group_id]) # Iterate over each inbound rule and revoke the open ports for rule in response['SecurityGroups'][0]['IpPermissions']: if 'FromPort' in rule and 'ToPort' in rule: from_port = rule['FromPort'] to_port = rule['ToPort'] if from_port != to_port: ec2.revoke_security_group_ingress( GroupId=security_group_id, IpPermissions=[{ 'FromPort': from_port, 'ToPort': to_port, 'IpProtocol': rule['IpProtocol'], 'IpRanges': [{'CidrIp': '0.0.0.0/0'}] }] ) else: ec2.revoke_security_group_ingress( GroupId=security_group_id, IpPermissions=[{ 'FromPort': from_port, 'ToPort': to_port, 'IpProtocol': rule['IpProtocol'], 'IpRanges': [{'CidrIp': '0.0.0.0/0'}] }] ) print("Security group remediated successfully.") ``` 3. Replace `'YOUR_SECURITY_GROUP_ID'` with the actual ID of the security group that you want to remediate. 4. Run the Python script. It will iterate over each inbound rule in the specified security group and revoke the open ports for external traffic. By following these steps, you can remediate the issue of open ports for external traffic in AWS Security Groups using Python and the Boto3 library. ```hcl theme={null} # Security group attached to the EC2 instance; keep this, but do NOT define # any rule that has protocol = "-1" with 0.0.0.0/0 or ::/0. resource "aws_security_group" "SERVICE_SG" { name = "SERVICE_SG" description = "Security group for SERVICE_NAME" vpc_id = aws_vpc.VPC_ID.id # substitute your VPC resource tags = { Name = "SERVICE_SG" } } # Example of a *restricted* ingress rule for a specific service (e.g., HTTPS from a private CIDR), # instead of "all traffic" from the entire internet. resource "aws_vpc_security_group_ingress_rule" "service_https_from_private" { security_group_id = aws_security_group.SERVICE_SG.id ip_protocol = "tcp" from_port = 443 to_port = 443 cidr_ipv4 = "10.0.0.0/16" # substitute with your allowed IPv4 CIDR } # If you previously had rules like the following, REMOVE those Terraform resources entirely: # (they are the Terraform equivalent of the aws ec2 revoke-security-group-ingress commands) # # resource "aws_vpc_security_group_ingress_rule" "all_traffic_ipv4" { # security_group_id = aws_security_group.SERVICE_SG.id # ip_protocol = "-1" # cidr_ipv4 = "0.0.0.0/0" # } # # resource "aws_vpc_security_group_ingress_rule" "all_traffic_ipv6" { # security_group_id = aws_security_group.SERVICE_SG.id # ip_protocol = "-1" # cidr_ipv6 = "::/0" # } ``` Removing the `aws_vpc_security_group_ingress_rule` resources that model `ip_protocol = "-1"` with `cidr_ipv4 = "0.0.0.0/0"` or `cidr_ipv6 = "::/0"` is a permanent change and can break traffic if those rules are currently used; ensure you have more specific rules in place first. On `terraform plan`, you should see the offending `aws_vpc_security_group_ingress_rule` resources scheduled for `- destroy` and any new, restricted ingress rules (like the HTTPS example) scheduled for `+ create`. ### Additional Reading: * [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html)