> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ports Should Not Be Open for Internal Traffic ### More Info: Security groups should not have all ports or protocols open to the internal traffic. Security groups should be created on a per-service basis and avoid allowing all ports or protocols even for internal access. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the issue of ports being open for internal traffic in AWS Security Groups, you can follow these steps using the AWS Management Console: 1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to the AWS Management Console. 2. **Navigate to the EC2 Dashboard**: Click on the "Services" dropdown menu at the top of the page, select "EC2" under the Compute section. 3. **Select Security Groups**: In the EC2 Dashboard, on the left-hand side, under "Network & Security", click on "Security Groups". 4. **Identify the Security Group**: Identify the security group that has ports open for internal traffic that you want to remediate. 5. **Edit Inbound Rules**: Select the security group by clicking on the checkbox next to it, then click on the "Inbound Rules" tab at the bottom. 6. **Review Inbound Rules**: Review the existing inbound rules to identify the ports that are open for internal traffic. 7. **Remove Internal Traffic Rules**: To remediate the issue, you need to remove the rules that allow internal traffic. Select the rule that allows internal traffic (usually with a source IP range corresponding to the VPC CIDR block or a specific security group), then click on the "Delete" button. 8. **Add Specific Rules**: If necessary, you can add specific rules to allow traffic only from trusted sources. Click on the "Add Rule" button, select the type of rule (e.g., HTTP, HTTPS, SSH), specify the allowed source (e.g., your IP address, a specific IP range), and click "Save". 9. **Review Changes**: Review the changes you have made to ensure that only necessary ports are open for external traffic. 10. **Save Changes**: Once you are satisfied with the changes, click on the "Save Rules" button to apply the updated security group configuration. By following these steps, you can remediate the issue of ports being open for internal traffic in AWS Security Groups and ensure that your resources are properly secured. # To remediate the issue of ports being open for internal traffic in AWS Security Groups using AWS CLI, follow these steps: 1. Identify the Security Group that has the open ports for internal traffic: Run the following AWS CLI command to list all the Security Groups in your AWS account: ``` aws ec2 describe-security-groups ``` 2. Identify the Security Group ID of the Security Group that has the open ports for internal traffic. 3. Update the Security Group to restrict the open ports for internal traffic: Run the following AWS CLI command to revoke the ingress rule that allows internal traffic on the open port (replace `sg-xxxxxxxxxxxx` with the Security Group ID): ``` aws ec2 revoke-security-group-ingress --group-id sg-xxxxxxxxxxxx --protocol tcp --port --cidr ``` 4. Verify the Security Group rules: Run the following AWS CLI command to describe the Security Group rules and verify that the ingress rule allowing internal traffic on the open port has been revoked: ``` aws ec2 describe-security-groups --group-ids sg-xxxxxxxxxxxx ``` By following these steps, you can remediate the issue of ports being open for internal traffic in AWS Security Groups using AWS CLI. To remediate the issue of ports being open for internal traffic in AWS Security Groups using Python, you can follow these steps: Step 1: Install the necessary Python libraries Ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip: ```bash theme={null} pip install boto3 ``` Step 2: Write a Python script to identify and close the open ports Create a Python script that will identify the security groups with open ports for internal traffic and revoke the ingress rules. Here's an example script to get you started: ```python theme={null} import boto3 # Initialize the Boto3 client ec2 = boto3.client('ec2') # Get a list of all security groups response = ec2.describe_security_groups() for group in response['SecurityGroups']: for perm in group['IpPermissions']: # Check if the port is open for internal traffic if 'GroupId' in group and perm['IpProtocol'] == '-1' and 'UserIdGroupPairs' in perm: # Revoke the ingress rule ec2.revoke_security_group_ingress( GroupId=group['GroupId'], IpPermissions=[perm] ) print(f"Revoked ingress rule for {group['GroupId']}") print("Security groups remediated successfully.") ``` Step 3: Run the Python script Save the script to a file (e.g., `remediate_security_groups.py`) and run it using Python. Make sure you have the necessary AWS credentials configured for the Boto3 client. ```bash theme={null} python remediate_security_groups.py ``` This script will iterate through all security groups in your AWS account, identify any open ports for internal traffic, and revoke the ingress rules for those ports. Make sure to review the script and customize it according to your specific requirements before running it in your AWS environment. ```hcl theme={null} resource "aws_security_group" "SERVICE_SG" { name = "SERVICE_SG_NAME" # replace with the security group name description = "Security group for SERVICE_NAME" # replace with the service description vpc_id = AWS_VPC_ID # replace with the VPC ID # BEFORE (bad, remove this block): # This is equivalent to the JSON rule you would revoke with # aws ec2 revoke-security-group-ingress --ip-permissions '' # # ingress { # from_port = 0 # to_port = 65535 # protocol = "tcp" # cidr_blocks = ["10.0.0.0/8"] # overly broad internal range with all ports open # } # AFTER (good, keep only the specific ports/protocols actually needed): ingress { description = "Allow HTTPS from application subnet" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = [ "10.0.1.0/24", # replace with the specific internal CIDR(s) that need access ] } # add additional narrowly-scoped ingress rules here as needed, # each for a specific port or small range and minimal CIDR/source SG. } ``` This change removes the permissive ingress rule (all or wide range of ports from a broad internal CIDR) and replaces it with one or more narrowly scoped rules, matching the CLI’s `revoke-security-group-ingress` behavior. This will not replace the security group itself, but it will remove and recreate the affected ingress rule(s), which can briefly impact connectivity for that traffic. For verification, `terraform plan` should show the previous wide-open `ingress` block being removed and only the new, specific `ingress` rule(s) remaining on `aws_security_group.SERVICE_SG`. ### Additional Reading: * [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html)