mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 12:31:54 +00:00
chore(aws): enhance metadata for ec2 service (#9549)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
847645543a
commit
3317c0a5e0
@@ -52,6 +52,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS IAM service metadata to new format [(#9550)](https://github.com/prowler-cloud/prowler/pull/9550)
|
||||
- Enhance `user_registration_details` perfomance and user `mfa` evaluation [(#9236)](https://github.com/prowler-cloud/prowler/pull/9236)
|
||||
- Update AWS Cognito service metadata to new format [(#8853)](https://github.com/prowler-cloud/prowler/pull/8853)
|
||||
- Update AWS EC2 service metadata to new format [(#9549)](https://github.com/prowler-cloud/prowler/pull/9549)
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ami_public",
|
||||
"CheckTitle": "Ensure there are no EC2 AMIs set as Public.",
|
||||
"CheckTitle": "EC2 AMI owned by the account is not public",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "ami",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "Other",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure there are no EC2 AMIs set as Public.",
|
||||
"Risk": "When your AMIs are publicly accessible, they are available in the Community AMIs where everyone with an AWS account can use them to launch EC2 instances. Your AMIs could contain snapshots of your applications (including their data), therefore exposing your snapshots in this manner is not advised.",
|
||||
"Description": "**EC2 AMIs owned by the account** are evaluated for **public visibility** via their launch permissions. Images shared with all accounts (`Group=all`) are treated as publicly accessible.",
|
||||
"Risk": "Public AMIs expose image contents to any AWS account, undermining **confidentiality** and **integrity**:\n- Leakage of embedded secrets, configs, or data from referenced snapshots\n- Adversaries can fingerprint your stack, aiding targeted exploits or repackaging for supply chain abuse",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cancel-sharing-an-AMI.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html",
|
||||
"https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 modify-image-attribute --region <REGION> --image-id <EC2_AMI_ID> --launch-permission {\"Remove\":[{\"Group\":\"all\"}]}",
|
||||
"CLI": "aws ec2 modify-image-attribute --image-id <EC2_AMI_ID> --launch-permission \"Remove=[{Group=all}]\"",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/public-policies/public_8",
|
||||
"Other": "1. Open the Amazon EC2 console and go to AMIs\n2. Select the AMI with Visibility = Public\n3. Click Actions > Edit AMI permissions\n4. Under AMI availability, select Private\n5. Click Save changes",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "We recommend your EC2 AMIs are not publicly accessible, or generally available in the Community AMIs.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cancel-sharing-an-AMI.html"
|
||||
"Text": "Keep AMIs **private** and enforce **least privilege** launch permissions. Share only with specific accounts and review access routinely. Enable **block public access for AMIs**, sanitize images to remove secrets, encrypt backing snapshots, and apply lifecycle governance to retire outdated images.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ami_public"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+24
-13
@@ -1,30 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_client_vpn_endpoint_connection_logging_enabled",
|
||||
"CheckTitle": "EC2 Client VPN endpoints should have client connection logging enabled.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "EC2 Client VPN endpoint has client connection logging enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsEc2ClientVpnEndpoint",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "This control checks whether an AWS Client VPN endpoint has client connection logging enabled. The control fails if the endpoint doesn't have client connection logging enabled.",
|
||||
"Risk": "Client VPN endpoints allow remote clients to securely connect to resources in a Virtual Private Cloud (VPC) in AWS. Connection logs allow you to track user activity on the VPN endpoint and provides visibility.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html",
|
||||
"Description": "**AWS Client VPN endpoints** are evaluated for **client connection logging** that records client connect/disconnect events to CloudWatch Logs. The evaluation detects endpoints where this logging is disabled.",
|
||||
"Risk": "Without **Client VPN connection logs**, remote access lacks an **audit trail**, reducing detection and accountability.\n- Stolen credentials can be used unnoticed\n- Lateral movement and data exfiltration persist\nImpacts **confidentiality** and **integrity**; delayed investigation can degrade **availability**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-51",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/ec2-client-vpn-connection-log-enabled.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-51",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 modify-client-vpn-endpoint --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --connection-log-options Enabled=true,CloudWatchLogGroup=<CLOUDWATCH_LOG_GROUP_NAME>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: enable connection logging on a Client VPN endpoint\nResources:\n <example_resource_name>:\n Type: AWS::EC2::ClientVpnEndpoint\n Properties:\n ClientCidrBlock: 10.0.0.0/22\n ServerCertificateArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\n AuthenticationOptions:\n - Type: certificate-authentication\n MutualAuthentication:\n ClientRootCertificateChainArn: arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\n ConnectionLogOptions: # CRITICAL: enables client connection logging\n Enabled: true # CRITICAL: turns on logging\n CloudWatchLogGroup: <example_resource_name> # CRITICAL: destination log group\n```",
|
||||
"Other": "1. Open the Amazon VPC console and go to Client VPN Endpoints\n2. Select the endpoint and choose Actions > Modify client VPN endpoint\n3. Under Connection logging, check Enable\n4. For CloudWatch log group, select an existing log group\n5. Click Save changes",
|
||||
"Terraform": "```hcl\n# Terraform: enable connection logging on a Client VPN endpoint\nresource \"aws_ec2_client_vpn_endpoint\" \"<example_resource_name>\" {\n server_certificate_arn = \"arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\"\n client_cidr_block = \"10.0.0.0/22\"\n\n authentication_options {\n type = \"certificate-authentication\"\n root_certificate_chain_arn = \"arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/<example_resource_id>\"\n }\n\n connection_log_options { # CRITICAL: enables client connection logging\n enabled = true # CRITICAL: turns on logging\n cloudwatch_log_group = \"<example_resource_name>\" # CRITICAL: destination log group\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "To enable connection logging, see Enable connection logging for an existing Client VPN endpoint in the AWS Client VPN Administrator Guide.",
|
||||
"Url": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-client-vpn-connection-log-enabled.html"
|
||||
"Text": "Enable **client connection logging** on all Client VPN endpoints and send events to a centralized log group.\n- Enforce least privilege on log access\n- Define retention and immutability\n- Integrate with monitoring/alerts\n- Separate VPN operations from log administration\n- Review anomalous login patterns",
|
||||
"Url": "https://hub.prowler.com/check/ec2_client_vpn_endpoint_connection_logging_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"logging"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+22
-14
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ebs_default_encryption",
|
||||
"CheckTitle": "Check if EBS Default Encryption is activated.",
|
||||
"CheckTitle": "EBS default encryption is enabled",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "ebs",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2Volume",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check if EBS Default Encryption is activated.",
|
||||
"Risk": "If not enabled sensitive information at rest is not protected.",
|
||||
"Description": "**EBS** uses `encryption by default` at the account and region level, ensuring new volumes, snapshots, and AMI-backed volumes are automatically encrypted with a chosen **KMS key**",
|
||||
"Risk": "Without `encryption by default`, data on new **EBS volumes** and **snapshots** may be stored in plaintext. A compromised account or mis-shared snapshot can expose disk contents, enabling data exfiltration, offline analysis, and loss of **confidentiality**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/",
|
||||
"https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/configure-default-encryption.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 enable-ebs-encryption-by-default",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/general-policies/ensure-ebs-default-encryption-is-enabled#aws-console",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-ebs-default-encryption-is-enabled#terraform"
|
||||
"CLI": "aws ec2 enable-ebs-encryption-by-default --region <REGION>",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::EC2::EBSEncryptionByDefault\n Properties:\n Enabled: true # Critical: turns on default EBS encryption in this region\n```",
|
||||
"Other": "1. In the AWS console, switch to the affected Region\n2. Go to EC2 > Settings (or Account attributes) > EBS encryption\n3. Click Enable default encryption and Save",
|
||||
"Terraform": "```hcl\nresource \"aws_ebs_encryption_by_default\" \"<example_resource_name>\" {\n enabled = true # Critical: enables default EBS encryption in this region\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.",
|
||||
"Url": "https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/"
|
||||
"Text": "Enable `EBS encryption by default` in every region and select a **customer-managed KMS key**. Apply **least privilege** to key use, rotate keys, and monitor access. Enforce encrypted volume creation with organizational guardrails and secure templates as **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ebs_default_encryption"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+17
-11
@@ -1,29 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ebs_public_snapshot",
|
||||
"CheckTitle": "Ensure there are no EBS Snapshots set as Public.",
|
||||
"CheckTitle": "EBS snapshot is not public",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "snapshot",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "Other",
|
||||
"ResourceType": "AwsEc2Volume",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure there are no EBS Snapshots set as Public.",
|
||||
"Risk": "When you share a snapshot, you are giving others access to all of the data on the snapshot. Share snapshots only with people with whom you want to share all of your snapshot data.",
|
||||
"Description": "**EBS snapshots** with **public sharing** permissions (accessible by all AWS accounts) are identified, as opposed to snapshots shared privately with specific accounts.",
|
||||
"Risk": "Public snapshots expose full volume contents, harming **confidentiality**. Any account can create a volume from the snapshot to read files, secrets, or database data, enabling **data exfiltration**, broad reconnaissance, and facilitating **lateral movement**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/public-snapshots.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 modify-snapshot-attribute --region <REGION> --snapshot-id <EC2_SNAPSHOT_ID> --attribute createVolumePermission --operation remove --user-ids all",
|
||||
"CLI": "aws ec2 modify-snapshot-attribute --snapshot-id <EC2_SNAPSHOT_ID> --attribute createVolumePermission --operation-type remove --group-names all",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/public-policies/public_7",
|
||||
"Other": "1. Open the AWS Management Console and go to EC2\n2. In the left menu, select Snapshots\n3. Select the snapshot <EC2_SNAPSHOT_ID>\n4. Click Actions > Modify permissions\n5. Choose Private (remove Public/all if present)\n6. Click Save changes",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure the snapshot should be shared.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html"
|
||||
"Text": "Keep snapshots **private** and share only with specific accounts under **least privilege**. Enable `Block public access for Amazon EBS snapshots` regionally. Prefer **CMEK encryption** and avoid sharing keys broadly. Regularly review sharing permissions and monitor snapshot usage.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ebs_public_snapshot"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-14
@@ -1,29 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ebs_snapshot_account_block_public_access",
|
||||
"CheckTitle": "Ensure that public access to EBS snapshots is disabled",
|
||||
"CheckTitle": "All EBS snapshots have public access blocked",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "snapshot",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsAccount",
|
||||
"ResourceGroup": "governance",
|
||||
"Description": "EBS snapshots can be shared with other AWS accounts or made public. By default, EBS snapshots are private and only the AWS account that created the snapshot can access it. If an EBS snapshot is shared with another AWS account or made public, the data in the snapshot can be accessed by the other account or by anyone on the internet. Ensure that public access to EBS snapshots is disabled.",
|
||||
"Risk": "If public access to EBS snapshots is enabled, the data in the snapshot can be accessed by anyone on the internet.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable",
|
||||
"ResourceType": "AwsEc2Volume",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "**EBS snapshots** account/Region configuration for **Block Public Access** is assessed to see whether public sharing is fully blocked (`block-all-sharing`) versus only new sharing (`block-new-sharing`) or unblocked. The state indicates if any snapshot can be publicly shared.",
|
||||
"Risk": "Without `block-all-sharing`, previously public snapshots can remain accessible, exposing raw disk data.\n\nImpacts:\n- Loss of **confidentiality** (PII, keys, configs)\n- Unauthorized cloning enabling **lateral movement**\n- Cross-account copies create **irreversible data leakage**",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable",
|
||||
"https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 enable-snapshot-block-public-access --state block-all-sharing",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SnapshotBlockPublicAccess\n Properties:\n State: block-all-sharing # CRITICAL: Blocks all public sharing of EBS snapshots in this Region to pass the check\n```",
|
||||
"Other": "1. In the AWS console, select the target Region in the top-right.\n2. Go to EC2 > Snapshots.\n3. Click Settings > Block public access for snapshots.\n4. Select Block all sharing.\n5. Click Save changes.",
|
||||
"Terraform": "```hcl\nresource \"aws_ebs_snapshot_block_public_access\" \"<example_resource_name>\" {\n state = \"block-all-sharing\" # CRITICAL: Blocks all public sharing of EBS snapshots in this Region\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use the following procedures to configure and monitor block public access for snapshots.",
|
||||
"Url": "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable"
|
||||
"Text": "Set **Block Public Access** for EBS snapshots to `block-all-sharing` in all active Regions.\n\nApply **least privilege** and guardrails (SCPs) to prevent changes. Regularly inventory snapshots, remove public sharing, and use segregated accounts with strict reviews for any necessary external sharing.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ebs_snapshot_account_block_public_access"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-14
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ebs_snapshots_encrypted",
|
||||
"CheckTitle": "Check if EBS snapshots are encrypted.",
|
||||
"CheckTitle": "EBS snapshot is encrypted",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "snapshot",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2Volume",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check if EBS snapshots are encrypted.",
|
||||
"Risk": "Data encryption at rest prevents data visibility in the event of its unauthorized access or theft.",
|
||||
"Description": "**EBS snapshots** are evaluated for **encryption at rest** with AWS KMS. The finding identifies snapshots where encryption is not enabled.",
|
||||
"Risk": "Unencrypted snapshots expose complete disk images to anyone with snapshot access or if mis-shared. Attackers can exfiltrate data, harvest credentials, and clone volumes for offline analysis, compromising **confidentiality** and enabling **lateral movement**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default",
|
||||
"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/snapshot-encrypted.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 --region <REGION> enable-ebs-encryption-by-default",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#aws-console",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#terraform"
|
||||
"CLI": "aws ec2 copy-snapshot --source-region <SOURCE_REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --description \"Encrypted copy of <SNAPSHOT_ID>\"",
|
||||
"NativeIaC": "",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Snapshots and select the unencrypted snapshot\n2. Click Actions > Copy snapshot\n3. Check Encrypt this snapshot (leave the default KMS key unless a specific key is required)\n4. Click Copy snapshot and wait for the new encrypted snapshot to be available\n5. Select the original unencrypted snapshot > Actions > Delete snapshot > Delete",
|
||||
"Terraform": "```hcl\nresource \"aws_ebs_snapshot_copy\" \"<example_resource_name>\" {\n source_snapshot_id = \"<UNENCRYPTED_SNAPSHOT_ID>\"\n source_region = \"<SOURCE_REGION>\"\n encrypted = true # Critical: creates an encrypted copy of the snapshot to remediate the finding\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Encrypt all EBS Snapshot and Enable Encryption by default. You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default"
|
||||
"Text": "Encrypt all **EBS snapshots** and enable `encryption by default` to prevent unencrypted creations and copies. Use **customer-managed KMS keys** for control and rotation, restrict snapshot sharing, and enforce **least privilege** on snapshot and key permissions as **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ebs_snapshots_encrypted"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-14
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ebs_volume_encryption",
|
||||
"CheckTitle": "Ensure there are no EBS Volumes unencrypted.",
|
||||
"CheckTitle": "EBS volume is encrypted",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "volume",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "medium",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2Volume",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Ensure there are no EBS Volumes unencrypted.",
|
||||
"Risk": "Data encryption at rest prevents data visibility in the event of its unauthorized access or theft.",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "**EBS volumes** are assessed for **encryption at rest** using **AWS KMS**.\n\nThe finding identifies volumes whose `encrypted` state is disabled, meaning data is stored unencrypted on block storage.",
|
||||
"Risk": "Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining **confidentiality**.\n\nAdversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting **integrity** and enabling **lateral movement**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/ebs-encrypted.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 create-snapshot --volume-id <VOLUME_ID> --description \"Snapshot for encryption\" && aws ec2 copy-snapshot --source-region <REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --description \"Encrypted snapshot\" && aws ec2 create-volume --snapshot-id <ENCRYPTED_SNAPSHOT_ID> --availability-zone <AZ> --encrypted",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Encrypted EBS volume\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Volume\n Properties:\n AvailabilityZone: <example_az>\n Size: 1\n Encrypted: true # CRITICAL: enables EBS encryption so the volume is created encrypted\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Volumes and select the unencrypted volume\n2. Choose Actions > Create snapshot and wait for it to complete\n3. Open the snapshot, click Actions > Create volume, select the same Availability Zone, and check Encrypted, then create\n4. Stop the instance using the old volume\n5. Detach the old (unencrypted) volume\n6. Attach the new encrypted volume to the instance using the same device name\n7. Start the instance\n8. Verify the new volume shows Encrypted = Yes",
|
||||
"Terraform": "```hcl\n# Encrypted EBS volume\nresource \"aws_ebs_volume\" \"<example_resource_name>\" {\n availability_zone = \"<example_az>\"\n size = 1\n encrypted = true # CRITICAL: ensures the volume is created encrypted\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Encrypt all EBS volumes and Enable Encryption by default You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"
|
||||
"Text": "Encrypt all EBS volumes and enable `encryption by default` for new volumes and snapshot copies.\n\nApply **least privilege** to KMS keys, restrict snapshot sharing, and enforce **defense in depth** with policies and templates that prevent creation of unencrypted storage.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ebs_volume_encryption"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+22
-15
@@ -1,33 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ebs_volume_protected_by_backup_plan",
|
||||
"CheckTitle": "Amazon EBS volumes should be protected by a backup plan.",
|
||||
"CheckTitle": "EBS volume is protected by a backup plan",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks, AWS Security Best Practices"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Destruction"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:volume/volume-id",
|
||||
"Severity": "low",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Volume",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Evaluates if an Amazon EBS volume in in-use state is covered by a backup plan. The check fails if an EBS volume isn't covered by a backup plan. If you set the backupVaultLockCheck parameter equal to true, the control passes only if the EBS volume is backed up in an AWS Backup locked vault.",
|
||||
"Risk": "Without backup coverage, Amazon EBS volumes are vulnerable to data loss or deletion, reducing the resilience of your systems and making recovery from incidents more difficult.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ebs-resources-protected-by-backup-plan.html",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "**EBS volumes** are evaluated for coverage by an **AWS Backup plan**, whether explicitly targeted or included via broad resource selection, confirming scheduled, policy-driven backups exist for the volume.",
|
||||
"Risk": "Absent backup coverage, volumes face **data loss**, weakened **integrity**, and reduced **availability**. Deletion or corruption-whether accidental or malicious-can leave no recovery path, causing prolonged outages, failed point-in-time restoration, unmet retention needs, and harder incident response.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.amazonaws.cn/en_us/aws-backup/latest/devguide/vault-lock.html",
|
||||
"https://aws.amazon.com/blogs/storage/protecting-your-critical-amazon-ebs-volumes-using-aws-backup/",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/ebs-resources-protected-by-backup-plan.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-28",
|
||||
"Terraform": ""
|
||||
"CLI": "aws backup create-backup-selection --backup-plan-id <BACKUP_PLAN_ID> --backup-selection '{\"SelectionName\":\"<example_resource_name>\",\"IamRoleArn\":\"arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole\",\"Resources\":[\"arn:aws:ec2:*:*:volume/*\"]}'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: protect all EBS volumes by assigning them to a backup plan\nResources:\n <example_resource_name>BackupPlan:\n Type: AWS::Backup::BackupPlan\n Properties:\n BackupPlan:\n BackupPlanName: <example_resource_name>\n Rules:\n - RuleName: <example_rule_name>\n TargetBackupVault: Default\n\n <example_resource_name>BackupSelection:\n Type: AWS::Backup::BackupSelection\n Properties:\n BackupPlanId: !Ref <example_resource_name>BackupPlan\n BackupSelection:\n SelectionName: <example_resource_name>\n IamRoleArn: arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole\n Resources:\n - arn:aws:ec2:*:*:volume/* # Critical: wildcard includes all EBS volumes so they are covered by the plan\n```",
|
||||
"Other": "1. In the AWS Backup console, go to Backup plans and click Create backup plan\n2. Choose Start with a template (any), keep the Default vault, and create the plan\n3. Open the plan and click Assign resources\n4. Set Selection name and choose IAM role AWSBackupDefaultServiceRole\n5. Under Assign resources, choose Include specific resource types and select EBS\n6. For Resources, select all EBS volumes (or the specific volumes to protect) and click Assign resources",
|
||||
"Terraform": "```hcl\n# Minimal AWS Backup plan protecting all EBS volumes\nresource \"aws_backup_plan\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n\n rule {\n rule_name = \"<example_rule_name>\"\n target_vault_name = \"Default\"\n }\n}\n\nresource \"aws_backup_selection\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n plan_id = aws_backup_plan.<example_resource_name>.id\n iam_role_arn = \"arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole\"\n\n resources = [\n \"arn:aws:ec2:*:*:volume/*\" # Critical: selects all EBS volumes to satisfy the check\n ]\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that all in-use Amazon EBS volumes are included in a backup plan, and consider using AWS Backup Vault Lock for additional protection.",
|
||||
"Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html"
|
||||
"Text": "Include all critical EBS volumes in standardized **AWS Backup** plans aligned to your `RPO`/`RTO`. Use tags for automatic assignment, enable cross-Region/account copies, apply **Vault Lock** for WORM retention, encrypt with KMS, enforce least-privilege access, and regularly test restores to verify integrity.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ebs_volume_protected_by_backup_plan"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"redundancy"
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+21
-15
@@ -1,32 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_ebs_volume_snapshots_exists",
|
||||
"CheckTitle": "Check if EBS snapshots exists.",
|
||||
"CheckTitle": "EBS volume has at least one snapshot",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Destruction"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "volume",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "medium",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2Volume",
|
||||
"ResourceGroup": "storage",
|
||||
"Description": "Check if EBS snapshots exists.",
|
||||
"Risk": "Ensure that your EBS volumes (available or in-use) have recent snapshots (taken weekly) available for point-in-time recovery for a better, more reliable data backup strategy.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "**EBS volumes** are evaluated for the existence of at least one associated **snapshot**, identifying volumes without any point-in-time backup available.",
|
||||
"Risk": "Missing **EBS snapshots** removes point-in-time recovery. Accidental deletion, corruption, or ransomware can cause **irrecoverable data loss** and prolonged **service outages**, degrading data **integrity** and **availability** and complicating recovery and forensics.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-snapshots.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/ebs-volumes-recent-snapshots.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 --region <REGION> create-snapshot --volume-id <VOLUME-ID>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/EBS/ebs-volumes-recent-snapshots.html",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 create-snapshot --region <REGION> --volume-id <VOLUME_ID>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: create a snapshot of an existing EBS volume\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Snapshot\n Properties:\n VolumeId: <example_resource_id> # Critical: creates a snapshot for this volume to pass the check\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2\n2. Click Volumes, select the target EBS volume\n3. Choose Actions > Create snapshot\n4. Click Create snapshot to confirm",
|
||||
"Terraform": "```hcl\n# Create a snapshot for an existing EBS volume\nresource \"aws_ebs_snapshot\" \"<example_resource_name>\" {\n volume_id = \"<example_resource_id>\" # Critical: creating this snapshot makes the volume pass the check\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Creating point-in-time EBS snapshots periodically will allow you to handle efficiently your data recovery process in the event of a failure, to save your data before shutting down an EC2 instance, to back up data for geographical expansion and to maintain your disaster recovery stack up to date.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html"
|
||||
"Text": "Establish automated, policy-based **EBS snapshot** coverage for all volumes aligned to business `RPO/RTO`.\n- Schedule regular snapshots with retention controls\n- Encrypt snapshots and enforce **least privilege** access\n- Replicate to another Region/account for DR\n- Periodically test restores and document procedures",
|
||||
"Url": "https://hub.prowler.com/check/ec2_ebs_volume_snapshots_exists"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"resilience",
|
||||
"forensics-ready"
|
||||
],
|
||||
"DependsOn": [],
|
||||
|
||||
+14
-9
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_elastic_ip_shodan",
|
||||
"CheckTitle": "Check if any of the Elastic or Public IP are in Shodan (requires Shodan API KEY).",
|
||||
"CheckTitle": "EC2 Elastic IP address is not listed in Shodan",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Discovery"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "high",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Eip",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Check if any of the Elastic or Public IP are in Shodan (requires Shodan API KEY).",
|
||||
"Risk": "Sites like Shodan index exposed systems and further expose them to wider audiences as a quick way to find exploitable systems.",
|
||||
"Description": "**EC2 Elastic IPs** are compared with **Shodan**'s index to identify publicly reachable addresses that have been scanned and cataloged, including metadata such as open ports, ISP, and geolocation",
|
||||
"Risk": "Being listed on **Shodan** confirms Internet exposure and reveals open services, versions, and banners. Adversaries can rapidly target these hosts for credential attacks and CVE exploits, threatening **confidentiality** (data access), **integrity** (system takeover), and **availability** (service disruption).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.shodan.io/",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000229484-ensure-any-of-the-elastic-or-public-ip-are-in-shodan"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Other": "1. In the AWS Console, go to EC2\n2. In the left pane, select Network & Security > Elastic IPs\n3. Select the flagged Elastic IP\n4. If it is associated: click Actions > Disassociate Elastic IP address > Disassociate\n5. Click Actions > Release Elastic IP address > Release",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Check Identified IPs, consider changing them to private ones and delete them from Shodan.",
|
||||
"Url": "https://www.shodan.io/"
|
||||
"Text": "Reduce attack surface with **defense in depth**:\n- Avoid public exposure; use private networking or proxies\n- Enforce **least-privilege** ingress rules; close unused ports\n- Patch and harden services; limit verbose banners\n- Rotate exposed IPs and continuously monitor external visibility",
|
||||
"Url": "https://hub.prowler.com/check/ec2_elastic_ip_shodan"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-12
@@ -1,32 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_elastic_ip_unassigned",
|
||||
"CheckTitle": "Check if there is any unassigned Elastic IP.",
|
||||
"CheckTitle": "Elastic IP is associated with an instance or network interface",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Resource Consumption"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsEc2Eip",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Check if there is any unassigned Elastic IP.",
|
||||
"Risk": "Unassigned Elastic IPs may result in extra cost.",
|
||||
"Description": "**EC2 Elastic IPs** that are allocated but **not associated** with any instance or network interface. The evaluation identifies EIPs present in the account without an active association.",
|
||||
"Risk": "Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (**availability**). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 release-address --public-ip <theIPyoudontneed>",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_19#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/general-policies/general_19#ec2-console",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_19#terraform"
|
||||
"CLI": "aws ec2 release-address --allocation-id <ALLOCATION_ID>",
|
||||
"NativeIaC": "```yaml\n# Associate an existing unassigned Elastic IP to an instance\nResources:\n <example_resource_name>:\n Type: AWS::EC2::EIPAssociation\n Properties:\n AllocationId: <example_allocation_id> # Critical: selects the unassigned EIP to associate\n InstanceId: <example_instance_id> # Critical: associates the EIP to this instance, fixing the finding\n```",
|
||||
"Other": "1. In the AWS console, go to EC2 > Network & Security > Elastic IPs\n2. Select the Elastic IP with Status = Not associated\n3. Choose Actions > Associate Elastic IP address\n4. Select Instance (or Network interface), pick the target, and click Associate\n5. Alternatively, to remove the finding by deleting the unused EIP: Actions > Release Elastic IP address > Release",
|
||||
"Terraform": "```hcl\n# Associate an existing unassigned Elastic IP to an instance\nresource \"aws_eip_association\" \"<example_resource_name>\" {\n allocation_id = \"<example_allocation_id>\" # Critical: target unassigned EIP\n instance_id = \"<example_instance_id>\" # Critical: attach EIP to this instance to pass the check\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure Elastic IPs are not unassigned.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html"
|
||||
"Text": "Release **unused Elastic IPs** or promptly associate them only where required. Enforce **least privilege** for address allocation, apply **tagging** to track ownership, and schedule periodic audits. Prefer **private networking** or managed front ends to reduce public IPv4 use. Automate reclaiming of `unassociated` addresses in lifecycle policies.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_elastic_ip_unassigned"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+20
-14
@@ -1,34 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_account_imdsv2_enabled",
|
||||
"CheckTitle": "Ensure Instance Metadata Service Version 2 (IMDSv2) is enforced for EC2 instances at the account level to protect against SSRF vulnerabilities.",
|
||||
"CheckTitle": "IMDSv2 is required by default for EC2 instances at the account level",
|
||||
"CheckType": [
|
||||
"Data Protection"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Credential Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsAccount",
|
||||
"ResourceGroup": "governance",
|
||||
"Description": "Ensure Instance Metadata Service Version 2 (IMDSv2) is enforced for EC2 instances at the account level to protect against SSRF vulnerabilities.",
|
||||
"Risk": "EC2 instances that use IMDSv1 are vulnerable to SSRF attacks.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "**EC2 account IMDS defaults** with `http_tokens`=`required` ensure new instances in the Region use **IMDSv2** by default and disable IMDSv1. *Existing instances keep their current setting.*",
|
||||
"Risk": "Without a default of **IMDSv2**, new instances may enable **IMDSv1**, exposing metadata via simple HTTP. SSRF or proxy misconfigs can steal **temporary IAM credentials**, enabling data exfiltration (confidentiality), unauthorized API changes (integrity), and lateral movement that can disrupt services (availability).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/require-imds-v2.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 modify-instance-metadata-defaults --region <region> --http-tokens required --http-put-response-hop-limit 2",
|
||||
"CLI": "aws ec2 modify-instance-metadata-defaults --region <region> --http-tokens required",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Other": "1. In the AWS Console, open EC2 and select the target Region\n2. Go to EC2 Dashboard > Account attributes > Data protection and security\n3. Next to IMDS defaults, click Manage\n4. Set Metadata version to V2 only (token required)\n5. Click Update",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable Instance Metadata Service Version 2 (IMDSv2) on the EC2 instances. Apply this configuration at the account level for each AWS Region to set the default instance metadata version.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults"
|
||||
"Text": "Enforce **IMDSv2** at the account level in every Region by setting `http_tokens` to `required`. Add guardrails with **SCP/IAM conditions**. Standardize AMIs and launch templates to require tokens, validate workload compatibility, and apply **least privilege** to instance roles for defense in depth. *For containers*, prefer hop limit `2`.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_account_imdsv2_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"internet-exposed",
|
||||
"ec2-imdsv1"
|
||||
"secrets"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+20
-12
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_detailed_monitoring_enabled",
|
||||
"CheckTitle": "Check if EC2 instances have detailed monitoring enabled.",
|
||||
"CheckTitle": "EC2 instance has detailed monitoring enabled",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check if EC2 instances have detailed monitoring enabled.",
|
||||
"Risk": "Enabling detailed monitoring provides enhanced monitoring and granular insights into EC2 instance metrics. Not having detailed monitoring enabled may limit the ability to troubleshoot performance issues effectively.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html",
|
||||
"Description": "**EC2 instances** are assessed for **CloudWatch detailed monitoring**, indicating whether 1-minute metrics collection is enabled.\n\nInstances lacking this setting provide only 5-minute metrics.",
|
||||
"Risk": "Without 1-minute metrics, visibility drops, delaying detection of:\n- Sudden CPU/network/disk spikes affecting **availability**\n- **Malicious workloads** (crypto-mining, brute force)\n- **Data exfiltration** patterns\nSlower detection expands blast radius, raising incident impact and response cost.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/instance-detailed-monitoring.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html#enable-detailed-monitoring-instance"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 monitor-instances --instance-ids <EC2_INSTANCE_ID>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/instance-detailed-monitoring.html",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/logging-policies/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances#terraform"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable detailed monitoring on an EC2 instance\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \"<example_ami_id>\"\n InstanceType: \"<example_instance_type>\"\n Monitoring: true # Critical: enables detailed (1-minute) CloudWatch monitoring\n```",
|
||||
"Other": "1. Open the AWS Console and go to EC2 > Instances\n2. Select the instance\n3. Choose Actions > Monitor and troubleshoot > Manage detailed monitoring\n4. Check Enable detailed monitoring and click Save",
|
||||
"Terraform": "```hcl\n# Enable detailed monitoring on an EC2 instance\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"<example_ami_id>\"\n instance_type = \"<example_instance_type>\"\n monitoring = true # Critical: enables detailed (1-minute) CloudWatch monitoring\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable detailed monitoring for EC2 instances to gain better insights into performance metrics.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html#enable-detailed-monitoring-instance"
|
||||
"Text": "Enable **detailed monitoring** to collect `1-minute` metrics on critical instances. Use **defense in depth**: baseline normal behavior, create alerts for anomalies, and correlate metrics with logs and traces. Review dashboards regularly. *If costs matter*, prioritize production, internet-facing, and autoscaling fleets.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_detailed_monitoring_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"logging",
|
||||
"forensics-ready"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+20
-11
@@ -1,33 +1,42 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_imdsv2_enabled",
|
||||
"CheckTitle": "Check if EC2 Instance Metadata Service Version 2 (IMDSv2) is Enabled and Required.",
|
||||
"CheckTitle": "EC2 instance requires IMDSv2 or has the instance metadata service disabled",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Credential Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check if EC2 Instance Metadata Service Version 2 (IMDSv2) is Enabled and Required.",
|
||||
"Risk": "Using IMDSv2 will protect from misconfiguration and SSRF vulnerabilities. IMDSv1 will not.",
|
||||
"Description": "**EC2 instances** are evaluated for **IMDSv2 enforcement**: metadata endpoint enabled with `http_tokens: required`, or metadata service fully disabled (`http_endpoint: disabled`).",
|
||||
"Risk": "Permitting **IMDSv1** or optional tokens lets SSRF or compromised workloads retrieve **temporary IAM credentials**, impacting confidentiality and integrity. Stolen role creds can drive **privilege escalation**, unauthorized data access, and lateral movement across AWS resources.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/require-imds-v2.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000234166-5-7-ensure-that-the-ec2-metadata-service-only-allows-imdsv2-automated-",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html#configuring-instance-metadata-options"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --http-endpoint enabled",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_31#cloudformation",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/require-imds-v2.html",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_31#terraform"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: enforce IMDSv2 on an EC2 instance\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \"<example_resource_id>\"\n InstanceType: \"<example_resource_name>\"\n MetadataOptions:\n HttpTokens: required # Critical: Require IMDSv2 tokens (blocks IMDSv1)\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Instances\n2. Select the instance > Actions > Instance settings > Modify instance metadata options\n3. Set Metadata version to IMDSv2 only (HTTP tokens: Required)\n4. Ensure Instance metadata service is Enabled (or set to Disabled to turn off IMDS entirely)\n5. Click Save",
|
||||
"Terraform": "```hcl\n# Enforce IMDSv2 on an EC2 instance\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"<example_resource_id>\"\n instance_type = \"<example_resource_name>\"\n\n metadata_options {\n http_tokens = \"required\" # Critical: Require IMDSv2 tokens (blocks IMDSv1)\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "If you don't need IMDS you can turn it off. Using aws-cli you can force the instance to use only IMDSv2.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html#configuring-instance-metadata-options"
|
||||
"Text": "Apply defense in depth:\n- Require **IMDSv2** tokens on all instances (`http_tokens: required`)\n- Disable metadata where not needed (`http_endpoint: disabled`)\n- Minimize hop limit to `1` when feasible\n- Update SDKs/apps for IMDSv2\n- Restrict instance profile permissions (least privilege)\n- Block metadata access from untrusted workloads",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_imdsv2_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"ec2-imdsv1"
|
||||
"identity-access",
|
||||
"secrets"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+21
-13
@@ -1,33 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_internet_facing_with_instance_profile",
|
||||
"CheckTitle": "Check for internet facing EC2 instances with Instance Profiles attached.",
|
||||
"CheckTitle": "EC2 instance is not internet-facing with an instance profile attached",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access",
|
||||
"TTPs/Credential Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "medium",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check for internet facing EC2 instances with Instance Profiles attached.",
|
||||
"Risk": "Exposing an EC2 directly to internet increases the attack surface and therefore the risk of compromise.",
|
||||
"Description": "**EC2 instances** with a public IP address and an attached **instance profile** (IAM role) are identified.\n\nInstances lacking public exposure or without an instance profile are excluded.",
|
||||
"Risk": "Publicly reachable instances with **IAM role credentials** expand the blast radius. Remote exploits or misconfigurations can steal credentials via the **instance metadata service**, enabling unauthorized API calls, data exfiltration, and lateral movement, impacting confidentiality, integrity, and availability.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html",
|
||||
"https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000127121-ensure-instance-profile-is-attached-for-internet-facing-ec2-instances"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 disassociate-iam-instance-profile --association-id <ASSOCIATION_ID>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: EC2 instance without a public IP to avoid being internet-facing\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: <example_ami_id>\n InstanceType: t3.micro\n NetworkInterfaces:\n - DeviceIndex: 0\n SubnetId: <example_resource_id>\n AssociatePublicIpAddress: false # Critical: disables public IPv4 so the instance is not internet-facing\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Instances and select the instance\n2. Choose Actions > Security > Modify IAM role\n3. Set IAM role to None and click Update IAM role\n4. Verify the instance no longer lists an IAM role (instance profile)\n\nAlternative (if you need the role): remove internet exposure\n1. Select the instance > Networking tab\n2. If an Elastic IP is attached, choose Disassociate Elastic IP\n3. For auto-assigned public IPv4, stop the instance and relaunch without a public IP or in a subnet without auto-assign public IPv4",
|
||||
"Terraform": "```hcl\n# EC2 instance without a public IP to avoid being internet-facing\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"<example_ami_id>\"\n instance_type = \"t3.micro\"\n associate_public_ip_address = false # Critical: disables public IPv4 so the instance is not internet-facing\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use an ALB and apply WAF ACL.",
|
||||
"Url": "https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/"
|
||||
"Text": "Avoid direct Internet exposure. Place workloads behind an **Application Load Balancer** and protect HTTP apps with **WAF**. Remove public IPs or restrict ingress to trusted sources. Apply **least privilege** to instance profiles and enforce **IMDSv2**. Use **bastion hosts** or **Session Manager** for admin access.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_internet_facing_with_instance_profile"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
"internet-exposed",
|
||||
"identity-access"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+21
-13
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_managed_by_ssm",
|
||||
"CheckTitle": "Check if EC2 instances are managed by Systems Manager.",
|
||||
"CheckTitle": "EC2 instance is managed by AWS Systems Manager or not running",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Patch Management"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check if EC2 instances are managed by Systems Manager.",
|
||||
"Risk": "AWS Config provides AWS Managed Rules, which are predefined, customizable rules that AWS Config uses to evaluate whether your AWS resource configurations comply with common best practices.",
|
||||
"Description": "**EC2 instances** are assessed for enrollment as **Systems Manager managed nodes**. Running instances lacking Systems Manager registration are marked as unmanaged; instances in `stopped`, `terminated`, or `pending` states are noted separately.",
|
||||
"Risk": "Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SSM/ssm-managed-instances.html",
|
||||
"https://docs.aws.amazon.com/systems-manager/latest/userguide/managed_instances.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SSM/ssm-managed-instances.html",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 stop-instances --instance-ids <INSTANCE_ID>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: make the instance SSM-managed by attaching the required IAM role\nResources:\n <example_resource_name>Role:\n Type: AWS::IAM::Role\n Properties:\n AssumeRolePolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n Service: ec2.amazonaws.com\n Action: sts:AssumeRole\n ManagedPolicyArns:\n - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore # CRITICAL: grants SSM permissions required for management\n\n <example_resource_name>InstanceProfile:\n Type: AWS::IAM::InstanceProfile\n Properties:\n Roles:\n - !Ref <example_resource_name>Role\n\n <example_resource_name>Instance:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: ami-<example_resource_id>\n InstanceType: t3.micro\n IamInstanceProfile: !Ref <example_resource_name>InstanceProfile # CRITICAL: attaches the SSM-enabled role to the instance\n```",
|
||||
"Other": "1. In IAM console: Create role > AWS service > EC2 > Next; attach policy \"AmazonSSMManagedInstanceCore\"; Create role\n2. In EC2 console: Instances > select the instance > Actions > Security > Modify IAM role > choose the role created above > Update IAM role\n3. Wait a few minutes; in Systems Manager console: Managed nodes, verify the instance shows as Online\n4. If the instance OS does not include SSM Agent by default, install the SSM Agent for that OS, then verify again",
|
||||
"Terraform": "```hcl\n# Terraform: make the instance SSM-managed by attaching the required IAM role\nresource \"aws_iam_role\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n assume_role_policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Principal = { Service = \"ec2.amazonaws.com\" }\n Action = \"sts:AssumeRole\"\n }]\n })\n}\n\nresource \"aws_iam_role_policy_attachment\" \"<example_resource_name>_ssm\" {\n role = aws_iam_role.<example_resource_name>.name\n policy_arn = \"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore\" # CRITICAL: grants SSM permissions required for management\n}\n\nresource \"aws_iam_instance_profile\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n role = aws_iam_role.<example_resource_name>.name\n}\n\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"ami-<example_resource_id>\"\n instance_type = \"t3.micro\"\n iam_instance_profile = aws_iam_instance_profile.<example_resource_name>.name # CRITICAL: attaches the SSM-enabled role to the instance\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Verify and apply Systems Manager Prerequisites.",
|
||||
"Url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/managed_instances.html"
|
||||
"Text": "Enroll all instances as **Systems Manager managed nodes**. Prefer **Session Manager** over SSH/RDP, restrict inbound admin ports, and use **least privilege** roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_managed_by_ssm"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"node-security"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+14
-9
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_older_than_specific_days",
|
||||
"CheckTitle": "Check EC2 Instances older than specific days.",
|
||||
"CheckTitle": "EC2 instance is not older than the configured maximum age or is not running",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Patch Management"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check EC2 Instances older than specific days.",
|
||||
"Risk": "Having old instances within your AWS account could increase the risk of having vulnerable software.",
|
||||
"Description": "**EC2 instances** are evaluated for age while in `running` state. Instances launched beyond the configurable limit (`max_ec2_instance_age_in_days`, default `180`) are flagged as older than the allowed lifetime. Stopped instances are ignored.",
|
||||
"Risk": "Long-lived instances often run **unpatched OS and agents**, enabling:\n- Exploitation of known CVEs loss of confidentiality\n- Privilege escalation and tampering integrity compromise\n- Malware/crypto-mining and instability reduced availability\n\nAged hosts also drift from baselines and impede response.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-patch-compliance-results.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/ec2-instance-too-old.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"CLI": "aws ec2 stop-instances --instance-ids <example_resource_id>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/ec2-instance-too-old.html",
|
||||
"Other": "1. Sign in to the AWS Management Console and open EC2\n2. Go to Instances and select the noncompliant instance\n3. Choose Instance state > Stop instance\n4. Confirm Stop\n5. Verify the instance state is Stopped (the check passes when the instance is not running)",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Check if software running in the instance is up to date and patched accordingly. Use AWS Systems Manager to patch instances and view patching compliance information.",
|
||||
"Url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-patch-compliance-results.html"
|
||||
"Text": "Adopt **short-lived, patched workloads**:\n- Rebuild regularly from hardened, updated images; rotate AMIs\n- Use centralized patch management and vulnerability scanning\n- Retire or modernize legacy hosts; tag for lifecycle\n- Apply **least privilege** and **defense in depth** to limit blast radius\n\nAdjust `max_ec2_instance_age_in_days` to match policy.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_older_than_specific_days"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+22
-13
@@ -1,30 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_paravirtual_type",
|
||||
"CheckTitle": "Amazon EC2 paravirtual virtualization type should not be used.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "EC2 instance virtualization type is HVM",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure that the virtualization type of an EC2 instance is not paravirtual. The control fails if the virtualizationType of the EC2 instance is set to paravirtual.",
|
||||
"Risk": "Using paravirtual instances can limit performance and security benefits offered by hardware virtual machine (HVM) instances, such as improved CPU, network, and storage efficiency.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-paravirtual-instance-check.html",
|
||||
"Description": "**EC2 instances** are evaluated for their virtualization mode. Instances with `virtualization_type` set to `paravirtual` are identified; those using **HVM** are recognized as hardware-assisted virtualization.",
|
||||
"Risk": "Using **paravirtual (PV)** weakens isolation versus **HVM/Nitro** and blocks features like `ENA` and `NVMe`. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-24",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/ec2-paravirtual-instance-check.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-24",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 terminate-instances --instance-ids <INSTANCE_ID>",
|
||||
"NativeIaC": "```yaml\n# Launch an EC2 instance using an HVM-based AMI\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: <HVM_AMI_ID> # Critical: Using an HVM AMI ensures virtualization type is HVM\n InstanceType: t3.micro\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Instances and select the instance with Virtualization type = paravirtual\n2. Launch a replacement instance using any HVM-based AMI (e.g., Amazon Linux 2)\n3. Verify the new instance is running\n4. Back in EC2 > Instances, select the paravirtual instance, choose Instance state > Terminate instance, and confirm",
|
||||
"Terraform": "```hcl\n# EC2 instance launched from an HVM AMI\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"<HVM_AMI_ID>\" # Critical: AMI must be HVM to pass the check\n instance_type = \"t3.micro\"\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "To update an EC2 instance to a new instance type, see Change the instance type in the Amazon EC2 User Guide.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html"
|
||||
"Text": "Standardize on **HVM/Nitro**. Migrate PV workloads to HVM AMIs and current instance families; ensure support for `ENA` and `NVMe`, current kernels, and hardened configs. Apply **defense in depth** and **least privilege**. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_paravirtual_type"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"node-security"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+18
-12
@@ -1,29 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_cassandra_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160).",
|
||||
"CheckTitle": "EC2 instance does not have Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160) open to the Internet",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160).",
|
||||
"Risk": "Cassandra is a distributed database management system designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure. Exposing Cassandra ports to the internet can lead to unauthorized access to the database, data exfiltration, and data loss.",
|
||||
"Description": "**EC2 instances** have **Cassandra service ports** (`7000`, `7001`, `7199`, `9042`, `9160`) reachable from the Internet through security group ingress.\n\nPublic IP presence and subnet exposure are considered to assess external reachability.",
|
||||
"Risk": "Internet-exposed Cassandra enables unauthorized queries on `9042`, remote management via `7199` (JMX), and tampering with inter-node channels on `7000/7001` and `9160`.\n\nAttackers can read/modify data (**confidentiality, integrity**), disrupt or take over the cluster (**availability**), and pivot within the VPC.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000127020-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-cassandra-ports-7199-or-9160-or-88"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":7000,\"ToPort\":7000,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":7001,\"ToPort\":7001,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":7199,\"ToPort\":7199,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9042,\"ToPort\":9042,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9160,\"ToPort\":9160,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]]'",
|
||||
"NativeIaC": "```yaml\n# Restrict Cassandra ports so they are not open to the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Cassandra ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 7000\n ToPort: 7000\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0; restricts Internet access\n - IpProtocol: tcp\n FromPort: 7001\n ToPort: 7001\n CidrIp: 10.0.0.0/8 # FIX\n - IpProtocol: tcp\n FromPort: 7199\n ToPort: 7199\n CidrIp: 10.0.0.0/8 # FIX\n - IpProtocol: tcp\n FromPort: 9042\n ToPort: 9042\n CidrIp: 10.0.0.0/8 # FIX\n - IpProtocol: tcp\n FromPort: 9160\n ToPort: 9160\n CidrIp: 10.0.0.0/8 # FIX\n```",
|
||||
"Other": "1. Open the AWS Console > EC2 > Instances and select the instance\n2. In the Security tab, click the attached Security Group(s)\n3. Click Edit inbound rules\n4. Remove or change any rule allowing TCP 7000, 7001, 7199, 9042, or 9160 from Anywhere (0.0.0.0/0 or ::/0)\n5. If needed, re-add those ports with a specific trusted source CIDR or security group\n6. Save rules",
|
||||
"Terraform": "```hcl\n# Security group with Cassandra ports not open to the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n # FIX: restrict these ports; do not use 0.0.0.0/0\n ingress { from_port = 7000 to_port = 7000 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 7001 to_port = 7001 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 7199 to_port = 7199 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 9042 to_port = 9042 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 9160 to_port = 9160 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP ports 7000, 7001, 7199, 9042 or 9160.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege network access**:\n- Remove `0.0.0.0/0` and `::/0` to Cassandra ports\n- Allow only trusted subnets or VPN/bastion\n- Keep nodes in private subnets; segment inter-node traffic\n- Enforce **authentication** and **TLS/mTLS** for clients and JMX\n- Add **defense in depth** with NACLs and monitoring",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_cassandra_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_cifs_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 139 or 445 (CIFS).",
|
||||
"CheckTitle": "EC2 instance does not allow Internet ingress to TCP ports 139 or 445 (CIFS)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 139 or 445 (CIFS).",
|
||||
"Risk": "CIFS is a file sharing protocol that is used to access files and printers on remote systems. It is not recommended to expose CIFS to the internet.",
|
||||
"Description": "**EC2 instances** with security groups permitting **inbound** TCP `139` or `445` (**CIFS/SMB**) from `0.0.0.0/0` are identified.\n\nExposure level reflects whether the instance has a **public IP** and the subnet's Internet reachability.",
|
||||
"Risk": "Publicly reachable **SMB** allows unauthorized access and **remote code execution**, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread **ransomware**, degrading **confidentiality**, **integrity**, and **availability**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-cifs-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":139,\"ToPort\":139,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":445,\"ToPort\":445,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Security group without CIFS open to the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: SG without CIFS open to Internet\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 139\n ToPort: 139\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict CIFS (139) to a non-Internet CIDR to avoid 0.0.0.0/0\n - IpProtocol: tcp\n FromPort: 445\n ToPort: 445\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict CIFS (445) to a non-Internet CIDR to avoid 0.0.0.0/0\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Edit Inbound rules\n4. Delete any rule allowing TCP port 139 or 445 from 0.0.0.0/0 or ::/0, or change the source to a specific trusted CIDR\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Security group without CIFS open to the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 139\n to_port = 139\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restrict CIFS (139); do not use 0.0.0.0/0\n }\n\n ingress {\n from_port = 445\n to_port = 445\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restrict CIFS (445); do not use 0.0.0.0/0\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 139 or 445 (CIFS).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict **CIFS/SMB** to trusted internal sources using **least privilege**; do not allow `0.0.0.0/0`.\n\nAdopt **defense in depth**: place hosts in private subnets, require **VPN** or controlled jump paths, and enforce **segmentation**. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_cifs_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_elasticsearch_kibana_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601).",
|
||||
"Risk": "Elasticsearch and Kibana are commonly used for log and data analysis. Allowing ingress from the internet to these ports can expose sensitive data to unauthorized users.",
|
||||
"Description": "**EC2 instances** with **Elasticsearch/Kibana ports** (`9200`, `9300`, `5601`) exposed to the Internet through inbound security group rules.\n\nAssesses reachability considering instance public IP and subnet to reflect real exposure.",
|
||||
"Risk": "Public access to Elasticsearch/Kibana can lead to:\n- Unauthorized queries or dashboard viewing confidentiality loss\n- Index changes or cluster control via `9300` integrity impact\n- Scans and bulk queries availability degradation\n\nEnables data exfiltration and lateral movement.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233821-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-elasticsearch-and-kibana-ports-tcp-9200-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":9200,\"ToPort\":9200,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9300,\"ToPort\":9300,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":5601,\"ToPort\":5601,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Elasticsearch/Kibana ports to a private CIDR (not the Internet)\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Elasticsearch/Kibana ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9200\n ToPort: 9200\n CidrIp: 10.0.0.0/8 # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict to internal CIDR\n - IpProtocol: tcp\n FromPort: 9300\n ToPort: 9300\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict source to stop Internet exposure\n - IpProtocol: tcp\n FromPort: 5601\n ToPort: 5601\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict source to stop Internet exposure\n```",
|
||||
"Other": "1. Open the AWS Console and go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. In Inbound rules, find any rule allowing TCP 9200, 9300, or 5601 from 0.0.0.0/0 or ::/0\n4. Edit inbound rules and either delete those rules or change the source to a restricted CIDR (e.g., your internal network)\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: restrict Elasticsearch/Kibana ports to a private CIDR (not the Internet)\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n # CRITICAL: restrict sources; do NOT use 0.0.0.0/0 or ::/0\n ingress {\n from_port = 9200\n to_port = 9200\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n ingress {\n from_port = 9300\n to_port = 9300\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n ingress {\n from_port = 5601\n to_port = 5601\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP ports 9200, 9300, 5601.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** to network exposure:\n- Restrict `9200`, `9300`, `5601` to trusted sources or keep them private\n- Use **private subnets**, **VPN/peering**, or **bastion/SSM** for admin access\n- Enforce **authentication** and **TLS** on Elasticsearch/Kibana\n- Avoid public IPs unless strictly required",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_elasticsearch_kibana_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_ftp_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 20 or 21 (FTP)",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 20 or 21 (FTP)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 20 or 21 (FTP).",
|
||||
"Risk": "FTP is an insecure protocol and should not be used. If FTP is required, it should be used over a secure channel such as FTPS or SFTP.",
|
||||
"Description": "**EC2 instances** with security groups permitting inbound **FTP** on `TCP 20-21` from any address (e.g., `0.0.0.0/0` or `::/0`) are identified.\n\nExposure is contextualized by the instance's public reachability (public IP and subnet).",
|
||||
"Risk": "Exposed **FTP** invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (**confidentiality**).\n\nAttackers can upload/alter files (**integrity**) and abuse services for malware staging or DoS (**availability**). Publicly reachable hosts are rapidly probed by scanners.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ftp-access.html",
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions 'IpProtocol=tcp,FromPort=20,ToPort=21,IpRanges=[{CidrIp=0.0.0.0/0}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict FTP (ports 20-21) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict FTP access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 20\n ToPort: 21\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict source; not 0.0.0.0/0. Fixes Internet exposure.\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule allowing TCP ports 20-21 from 0.0.0.0/0 or ::/0\n5. Delete the rule, or change Source to a trusted CIDR (e.g., your office IP)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Security group with FTP restricted\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 20\n to_port = 21\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restrict source; not 0.0.0.0/0. Fixes Internet exposure.\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 20 or 21 (FTP).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Deny public ingress to **FTP** ports `20-21` following **least privilege**. Prefer **SFTP** or **FTPS**; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply **defense in depth** with tightened security groups and network ACLs, and monitor authentication and access.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_ftp_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_kafka_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 9092 (Kafka).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 9092 (Kafka)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 9092 (Kafka).",
|
||||
"Risk": "Kafka is a distributed streaming platform that is used to build real-time data pipelines and streaming applications. Exposing the Kafka port to the internet can lead to unauthorized access to the Kafka cluster, which can result in data leakage, data corruption, and data loss.",
|
||||
"Description": "**EC2 instances** with security group rules that allow inbound `TCP 9092` (Kafka) from the Internet are reported. The evaluation inspects ingress rules to detect broad sources (for example `0.0.0.0/0` or `::/0`) that expose Kafka brokers.",
|
||||
"Risk": "Public Kafka access undermines CIA: adversaries can read topics and metadata (**confidentiality**), publish or alter events (**integrity**), and overwhelm brokers (**availability**). Exposure also eases reconnaissance and lateral movement from the broker host.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233794-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-9092-kafka-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 9092 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Kafka (9092) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Kafka port\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9092\n ToPort: 9092\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0; restrict to trusted CIDR to close Internet access\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Remove the rule allowing TCP 9092 from 0.0.0.0/0 or ::/0 (Internet)\n5. If needed, add TCP 9092 with a restricted source (e.g., your VPC CIDR)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict Kafka (9092) from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 9092\n to_port = 9092\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: restrict source; not 0.0.0.0/0\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 9092 (Kafka).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege**: restrict `TCP 9092` to trusted networks, not `0.0.0.0/0` or `::/0`. Keep brokers in private subnets and use private connectivity (VPN/peering). Enforce **TLS** and authenticated clients with granular ACLs, and add **defense in depth** via NACLs or proxies.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_kafka_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+17
-12
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_kerberos_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 88, 464, 749 or 750 (Kerberos).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 88, 464, 749, or 750 (Kerberos)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access/Unauthorized Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 88, 464, 749 or 750 (Kerberos).",
|
||||
"Risk": "Kerberos is a network authentication protocol that uses secret-key cryptography to authenticate clients and servers. It is typically used in environments where users need to authenticate to access network resources. If an EC2 instance allows ingress from the internet to TCP port 88 or 464, it may be vulnerable to unauthorized access.",
|
||||
"Description": "**EC2 instances** whose security groups allow public **inbound TCP** access to Kerberos ports `88`, `464`, `749`, or `750` (authentication, password change, admin).\n\nRules permitting `0.0.0.0/0` or `::/0` are treated as Internet-exposed.",
|
||||
"Risk": "Public Kerberos exposure risks CIA:\n- **Password spraying**/AS-REP roasting against accounts\n- Unauthorized password changes on `464`\n- Realm/user enumeration and DoS of KDC/services\n\nStolen tickets enable **lateral movement** and privilege escalation in Active Directory or the Kerberos realm.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233825-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-88-464-749-or-750-kerberos-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":88,\"ToPort\":88,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":464,\"ToPort\":464,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":749,\"ToPort\":749,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":750,\"ToPort\":750,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Kerberos ports from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Kerberos ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 88\n ToPort: 88\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restrict access to trusted CIDR\n - IpProtocol: tcp\n FromPort: 464\n ToPort: 464\n CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure\n - IpProtocol: tcp\n FromPort: 749\n ToPort: 749\n CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure\n - IpProtocol: tcp\n FromPort: 750\n ToPort: 750\n CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure\n```",
|
||||
"Other": "1. In the AWS console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Edit inbound rules\n4. Remove any rule allowing TCP ports 88, 464, 749, or 750 from 0.0.0.0/0 or ::/0\n5. If access is required, re-add these ports only from trusted CIDR(s) (e.g., your internal network)\n6. Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: restrict Kerberos ports from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 88\n to_port = 88\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restrict to trusted CIDR\n }\n\n ingress {\n from_port = 464\n to_port = 464\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: blocks Internet exposure\n }\n\n ingress {\n from_port = 749\n to_port = 749\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: blocks Internet exposure\n }\n\n ingress {\n from_port = 750\n to_port = 750\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: blocks Internet exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 88, 464, 749 or 750 (Kerberos).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict Kerberos ports to trusted sources only.\n- Prefer **private connectivity** (VPN, peering) over public exposure\n- Place KDCs/services in private subnets without public IPs\n- Apply **least privilege** with narrowly scoped security group rules and NACLs\n- Add defense-in-depth: host firewalls and monitor authentication activity",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_kerberos_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+17
-12
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_ldap_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 389 or 636 (LDAP).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 389 or 636 (LDAP/LDAPS)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 389 or 636 (LDAP).",
|
||||
"Risk": "LDAP is a protocol used for authentication and authorization. Exposing LDAP to the internet can lead to unauthorized access to the LDAP server and the data it contains.",
|
||||
"Description": "**EC2 instances** with security groups permitting Internet-sourced access to **LDAP** on `TCP 389` or **LDAPS** on `TCP 636` are identified.\n\nPublic exposure context (presence of public IP and subnet reachability) is considered to gauge how broadly these ports can be accessed.",
|
||||
"Risk": "Publicly reachable **LDAP/LDAPS** enables:\n- Directory enumeration and weak/anonymous bind attempts\n- **Password spraying** and credential theft (cleartext on `389`)\n- Unauthorized queries causing **data exfiltration**\n\nAbuse may lead to **privilege escalation** and availability impact via account lockouts.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":389,\"ToPort\":389,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":636,\"ToPort\":636,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict LDAP/LDAPS from the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restricted LDAP access\n VpcId: \"<example_resource_id>\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 389\n ToPort: 389\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restricts LDAP (389) to internal range\n - IpProtocol: tcp\n FromPort: 636\n ToPort: 636\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636) to internal range\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. In Inbound rules, find rules for TCP 389 or 636 with Source set to Anywhere (0.0.0.0/0 or ::/0)\n4. Delete those rule(s)\n5. (If access is required) Add inbound rules for TCP 389 and/or 636 scoped to specific trusted CIDR(s) only\n6. Save rules",
|
||||
"Terraform": "```hcl\n# Restrict LDAP/LDAPS from the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"restricted-ldap\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 389\n to_port = 389\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restricts LDAP (389)\n }\n\n ingress {\n from_port = 636\n to_port = 636\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636)\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 389 or 636 (LDAP).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Limit LDAP to trusted networks:\n- Allowlist specific source CIDRs in security groups (*least privilege*)\n- Use **private connectivity** (peering/VPN) instead of Internet\n- Require **LDAPS**, strong certificates, and disable insecure binds\n- Add NACLs and monitoring for defense in depth\n\n*If external access is required*, place a proxy and enforce rate limits.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_ldap_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+17
-12
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_memcached_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 11211 (Memcached).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 11211 (Memcached)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 11211 (Memcached).",
|
||||
"Risk": "Memcached is an open-source, high-performance, distributed memory object caching system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source must be read. Memcached is designed to be used in trusted environments and should not be exposed to the internet. If Memcached is exposed to the internet, it can be exploited by attackers to perform distributed denial-of-service (DDoS) attacks, data exfiltration, and other malicious activities.",
|
||||
"Description": "**EC2 instances** are evaluated for **open Memcached access**: inbound `TCP 11211` allowed from any address (`0.0.0.0/0` or `::/0`) via their security groups, considering the instance's public exposure.",
|
||||
"Risk": "Internet-exposed **Memcached** weakens:\n- **Availability**: abuse for reflection/amplification and resource exhaustion\n- **Confidentiality**: unauthorized reads of cached objects and metadata\n- **Integrity**: manipulation of cache entries influencing app behavior\n\nPublic reachability also aids reconnaissance and lateral movement.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000127021-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-memcached-port-11211"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 11211 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Memcached (11211) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Memcached access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 11211\n ToPort: 11211\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0; limits access to internal range to avoid Internet exposure\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. In Inbound rules, find the rule allowing TCP 11211 from 0.0.0.0/0 or ::/0\n4. Delete the rule or edit the Source to a restricted range (e.g., a private CIDR or a specific security group)\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Security group with Memcached (11211) not exposed to the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 11211\n to_port = 11211\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: not 0.0.0.0/0; restricts access to internal range\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 11211 (Memcached).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** on network access:\n- Restrict `TCP 11211` to trusted sources or internal subnets only\n- Place instances in private subnets; avoid public IPs\n- Layer **defense in depth** with NACLs and routing to block Internet paths\n- Prefer private connectivity (peering/VPN) and implement service-level authentication where available",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_memcached_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_mongodb_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 27017 or 27018 (MongoDB)",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 27017 or 27018 (MongoDB)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 27017 or 27018 (MongoDB).",
|
||||
"Risk": "MongoDB is a popular NoSQL database that is often used in web applications. If an EC2 instance allows ingress from the internet to TCP port 27017 or 27018, it may be vulnerable to unauthorized access and data exfiltration.",
|
||||
"Description": "**EC2 instances** with security groups permitting inbound `TCP 27017` or `27018` (MongoDB) from `0.0.0.0/0` or `::/0` are identified, factoring the instance's public reachability to gauge exposure.",
|
||||
"Risk": "Internet-exposed MongoDB invites scanning, brute force, and exploits leading to:\n- Data extraction (**confidentiality**)\n- Collection tampering or deletion (**integrity**)\n- DoS or ransomware disruptions (**availability**)\nA compromised DB host can also enable lateral movement within the environment.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233752-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-27017-or-27018-mongodb-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":27017,\"ToPort\":27017,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":27018,\"ToPort\":27018,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict MongoDB ports from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict MongoDB ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 27017\n ToPort: 27017\n CidrIp: 10.0.0.0/8 # Critical: restricts 27017 to internal CIDR (not 0.0.0.0/0)\n - IpProtocol: tcp\n FromPort: 27018\n ToPort: 27018\n CidrIp: 10.0.0.0/8 # Critical: restricts 27018 to internal CIDR (not 0.0.0.0/0)\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Delete any rule allowing TCP port 27017 or 27018 from 0.0.0.0/0 or ::/0\n5. If access is required, add a rule for those ports limited to a specific trusted CIDR (e.g., your VPC CIDR)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n # Critical: restrict MongoDB ports to internal CIDR, not 0.0.0.0/0 or ::/0\n ingress {\n from_port = 27017\n to_port = 27017\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n\n ingress {\n from_port = 27018\n to_port = 27018\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 27017 or 27018 (MongoDB).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** to MongoDB access:\n- Remove Internet-wide rules; allow only trusted sources\n- Keep DBs on **private subnets** without public IPs; use private connectivity or proxies\n- Enforce strong auth and **TLS**\n- Add segmentation and monitoring for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_mongodb_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_mysql_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 3306 (MySQL).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 3306 (MySQL)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 3306 (MySQL).",
|
||||
"Risk": "MySQL is a popular open-source relational database management system that is widely used in web applications. Exposing MySQL to the internet can lead to unauthorized access and data exfiltration.",
|
||||
"Description": "**EC2 instances** with security groups that expose **MySQL** on `TCP 3306` to the Internet (`0.0.0.0/0` or `::/0`) are identified, with context on public IP and subnet exposure.",
|
||||
"Risk": "Publicly reachable **MySQL** enables Internet scanning, brute force, and credential stuffing, leading to unauthorized queries and data dumps (**confidentiality**). Attackers can alter or delete data (**integrity**), overload the service with query floods (**availability**), and pivot from the DB host into adjacent workloads.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-mysql-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 3306 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict MySQL (3306) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict MySQL access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3306\n ToPort: 3306\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0; restrict 3306 to a private range\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Click Inbound rules > Edit inbound rules\n4. Find the rule allowing TCP 3306 from 0.0.0.0/0 or ::/0 and delete it\n5. (If access is required) Add a rule for TCP 3306 from a specific private CIDR or trusted IP range only\n6. Save rules",
|
||||
"Terraform": "```hcl\n# Restrict MySQL (3306) from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 3306\n to_port = 3306\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do NOT use 0.0.0.0/0; restrict 3306 to a private CIDR\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 3306 (MySQL).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict `TCP 3306` to trusted sources per **least privilege**:\n- Allow DB access only from specific application subnets or security groups\n- Place database hosts in private subnets without public IPs\n- Apply **defense in depth** with VPN/peering for admin access, TLS for connections, and host firewalls; optionally reinforce with NACLs",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_mysql_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_oracle_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 1521, 2483 or 2484 (Oracle).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 1521, 2483, or 2484 (Oracle)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 1521, 2483 or 2484 (Oracle).",
|
||||
"Risk": "Oracle database servers are a high value target for attackers. Allowing internet access to these ports could lead to unauthorized access to the database.",
|
||||
"Description": "**EC2 instances** with security groups allowing inbound `TCP` from any address to Oracle listener ports `1521`, `2483`, or `2484`",
|
||||
"Risk": "Exposed Oracle listener ports enable SID enumeration, credential brute force, and TNS abuse. A successful intrusion can grant database access, causing data exfiltration (C), unauthorized changes (I), and outages via exploits or DoS (A). Internet scanning quickly finds these endpoints, enlarging the attack surface.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-oracle-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 1521 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Restrict Oracle port from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Oracle port access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1521\n ToPort: 1521\n CidrIp: 10.0.0.0/16 # FIX: do not use 0.0.0.0/0 or ::/0; limits access to a trusted CIDR to block Internet\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. For TCP ports 1521, 2483, and 2484, delete any rule with Source 0.0.0.0/0 or ::/0\n5. If access is required, change the Source to a specific trusted CIDR only\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Security group with Oracle port restricted from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 1521\n to_port = 1521\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # FIX: restrict source; do not use 0.0.0.0/0 or ::/0\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 1521, 2483 or 2484.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict Oracle ports to trusted sources; remove `0.0.0.0/0` and `::/0`. Place databases in private subnets without public IPs. Use VPN/Direct Connect or bastions for access. Enable TLS on `2484`, strong auth, and apply **least privilege** rules with **defense in depth** using NACLs and monitoring.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_oracle_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_postgresql_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 5432 (PostgreSQL)",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 5432 (PostgreSQL)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 5432 (PostgreSQL).",
|
||||
"Risk": "PostgreSQL is a popular open-source relational database management system. Exposing the PostgreSQL port to the internet can lead to unauthorized access to the database, data exfiltration, and other security risks.",
|
||||
"Description": "**EC2 instances** with security group rules allowing inbound **PostgreSQL** on `TCP 5432` from the Internet (`0.0.0.0/0` or `::/0`) are identified, considering the instance's public reachability via IP and subnet.",
|
||||
"Risk": "Exposed `TCP 5432` enables unauthenticated Internet probes and **brute-force** attempts against PostgreSQL, risking database **confidentiality**, **integrity**, and **availability**. Attackers could dump data, alter schemas, create backdoor accounts, pivot within the VPC, or exploit unpatched flaws at scale.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-postgresql-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 5432 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict PostgreSQL (5432) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict PostgreSQL\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 5432\n ToPort: 5432\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; limits access to internal range\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the group attached to the instance\n3. In Inbound rules, find any rule for PostgreSQL (TCP 5432) with source 0.0.0.0/0 or ::/0\n4. Delete the rule or change the source to a specific trusted CIDR only\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Restrict PostgreSQL (5432) from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 5432\n to_port = 5432\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; prevents Internet exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 5432 (PostgreSQL).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict PostgreSQL to trusted sources only:\n- Remove `0.0.0.0/0` and `::/0` rules\n- Apply **least privilege** security groups (allow from app tier or VPN)\n- Place instances in private subnets without public IPs\n- Enforce **TLS** and strong auth; disable unused listeners\n- Layer with NACLs and monitoring for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_postgresql_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_rdp_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 3389 (RDP)",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 3389 (RDP)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/External Remote Services"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 3389 (RDP).",
|
||||
"Risk": "RDP is a proprietary protocol developed by Microsoft for connecting to Windows systems. Exposing RDP to the internet can allow attackers to brute force the login credentials and gain unauthorized access to the EC2 instance.",
|
||||
"Description": "**EC2 instances** whose security groups allow Internet-wide inbound **RDP** on `TCP 3389` (`0.0.0.0/0` or `::/0`). The instance's public IP and subnet routing are considered to determine external reachability.",
|
||||
"Risk": "Internet-exposed **RDP** allows:\n- **Brute force** and credential reuse on Windows logons\n- Exploitation of RDP flaws for remote code execution\n- **Lateral movement** and data exfiltration\nThis threatens **confidentiality**, **integrity**, and **availability** through data theft, tampering, account lockouts, or ransomware.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233789-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-3389-rdp-",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-rdp-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 3389 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict RDP so it's not open to the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict RDP access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3389\n ToPort: 3389\n CidrIp: <TRUSTED_CIDR> # CRITICAL: limit RDP to a specific CIDR to avoid 0.0.0.0/0 (::/0)\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Open each security group attached to the affected instance\n3. In Inbound rules, find any rule allowing TCP 3389 from 0.0.0.0/0 or ::/0\n4. Delete the rule, or edit Source to a specific trusted IP/CIDR only\n5. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict RDP so it's not open to the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 3389\n to_port = 3389\n protocol = \"tcp\"\n cidr_blocks = [\"<TRUSTED_CIDR>\"] # CRITICAL: restrict RDP to a specific CIDR; not 0.0.0.0/0 or ::/0\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 3389 (RDP).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Remove Internet-wide RDP. Apply **least privilege**:\n- Restrict `TCP 3389` to trusted IPs\n- Prefer private access via **VPN** or a hardened **bastion**; consider **Session Manager**\n- Use **just-in-time** access and short-lived rules\n- Enforce strong auth (e.g., NLA) and monitor logs\nAdopt **defense in depth** with layered network controls.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_rdp_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_redis_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 6379 (Redis).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 6379 (Redis)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 6379 (Redis).",
|
||||
"Risk": "Redis is an open-source, in-memory data structure store, used as a database, cache, and message broker. Redis is often used to store sensitive data, such as session tokens, user credentials, and other sensitive information. Allowing ingress from the internet to TCP port 6379 (Redis) can expose sensitive data to unauthorized users.",
|
||||
"Description": "**EC2 instances** with security groups permitting Internet access to **Redis** on `TCP 6379` are identified.\n\nExposure is assessed using public IP assignment and subnet reachability to reflect how broadly the service can be contacted.",
|
||||
"Risk": "Exposed **Redis** allows remote access to cached data and secrets, reducing **confidentiality**. Unauthorized commands (`SET`, `DEL`, `FLUSHALL`, config changes) can corrupt or erase data, harming **integrity**. Internet scanning and abuse can exhaust memory and disrupt service, degrading **availability** and enabling lateral movement.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233806-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-6379-redis-",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-redis-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 6379 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Redis (6379) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Redis ingress\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 6379\n ToPort: 6379\n CidrIp: 10.0.0.0/8 # Critical: restrict source CIDR (not 0.0.0.0/0 or ::/0) to block Internet access\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule allowing TCP port 6379 from 0.0.0.0/0 or ::/0\n5. Delete the rule, or change the source to a specific trusted CIDR or security group\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: restrict Redis (6379) from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 6379\n to_port = 6379\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0 or ::/0; restrict to trusted range\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 6379 (Redis).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** network access: restrict Redis to trusted sources or VPC-only, place instances in private subnets, and avoid public IPs.\n\nLayer controls with **NACLs** and host firewalls, enforce **authentication and TLS** on Redis, and use **VPN/bastion** or proxies to broker access.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_redis_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_sqlserver_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 1433 or 1434 (SQL Server).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 1433 or 1434 (SQL Server)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 1433 or 1434 (SQL Server).",
|
||||
"Risk": "SQL Server is a database management system that is used to store and retrieve data. If an EC2 instance allows ingress from the internet to TCP port 1433 or 1434, it may be vulnerable to unauthorized access and data exfiltration.",
|
||||
"Description": "**EC2 instances** with security groups permitting any source to `TCP 1433` or `1434` (SQL Server) are identified, considering the instance's public reachability based on IP and subnet exposure.",
|
||||
"Risk": "Internet-reachable SQL services enable:\n- Brute-force and credential-stuffing of DB logins\n- Exploitation of SQL Server flaws for remote code execution\n- Unauthorized queries and data exfiltration\nThis threatens **confidentiality** and **integrity**, and facilitates **lateral movement** from the database host.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000223371-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-windows-sql-server-ports-1433-or-14",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-mssql-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":1433,\"ToPort\":1434,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict SQL Server ports to non-Internet sources\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SQL ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1433\n ToPort: 1434\n CidrIp: 10.0.0.0/8 # FIX: do not use 0.0.0.0/0; limits access to internal range to close Internet exposure\n```",
|
||||
"Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the security group attached to the affected EC2 instance\n3. In the Inbound rules tab, click Edit inbound rules\n4. Delete any rule allowing TCP 1433 or 1434 from 0.0.0.0/0 or ::/0\n5. If access is required, add a rule for TCP 1433-1434 with a specific trusted source (e.g., your office IP or another security group)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict SQL Server ports to non-Internet sources\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 1433\n to_port = 1434\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: do not use 0.0.0.0/0; restricts access to prevent Internet exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 1433 or 1434 (SQL Server).",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Enforce **least privilege** and **defense in depth**:\n- Remove `0.0.0.0/0` and `::/0` to `1433-1434`\n- Allow only trusted IPs or app tiers via security group references\n- Keep databases in private subnets without public IPs; access via VPN or bastion\n- Require TLS and strong authentication; monitor access.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_sqlserver_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_ssh_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 22 (SSH)",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 22 (SSH)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/External Remote Services"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 22 (SSH).",
|
||||
"Risk": "SSH is a common target for brute force attacks. If an EC2 instance allows ingress from the internet to TCP port 22, it is at risk of being compromised.",
|
||||
"Description": "**EC2 instances** with **SSH (TCP 22)** exposed to the Internet via security group inbound rules allowing `0.0.0.0/0` or `::/0`.\n\nExposure is qualified using the instance's public IP status and subnet reachability.",
|
||||
"Risk": "**Internet-exposed SSH** invites **brute force** and **credential stuffing**. A successful sign-in grants **remote shell**, enabling data exfiltration, tampering of workloads, and **lateral movement** within the VPC, degrading confidentiality, integrity, and availability.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ssh-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":22,\"ToPort\":22,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":22,\"ToPort\":22,\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Restrict SSH so it's not open to the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SSH\n VpcId: \"<example_resource_id>\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 22\n ToPort: 22\n CidrIp: 10.0.0.0/8 # Critical: restrict SSH to a specific CIDR, not 0.0.0.0/0\n```",
|
||||
"Other": "1. Open the Amazon EC2 console and go to Security Groups\n2. Select the security group attached to the instance\n3. Click Inbound rules > Edit inbound rules\n4. Delete any rule allowing SSH (port 22) from 0.0.0.0/0 or ::/0\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: Restrict SSH so it's not open to the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 22\n to_port = 22\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: restrict SSH to a specific CIDR, not 0.0.0.0/0\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 22.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** on SSH:\n- Restrict ingress to trusted IPs; avoid `0.0.0.0/0` and `::/0`\n- Prefer **Session Manager** or a hardened **bastion** behind VPN\n- Use **key-based auth**; disable passwords\n- Add **defense in depth** with network controls and monitor access logs",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_ssh_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-12
@@ -1,29 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_port_telnet_exposed_to_internet",
|
||||
"CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 23 (Telnet).",
|
||||
"CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 23 (Telnet)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 23 (Telnet).",
|
||||
"Risk": "Telnet is an insecure protocol that transmits data in plain text. Exposure of Telnet services to the internet can lead to unauthorized access to the EC2 instance.",
|
||||
"Description": "EC2 instances with security groups allowing inbound **Telnet** on `TCP 23` from the Internet are identified, including open IPv4/IPv6 sources like `0.0.0.0/0` and `::/0`.\n\nExposure is evaluated considering public IP assignment and subnet reachability.",
|
||||
"Risk": "Exposed **Telnet** weakens **confidentiality** and **integrity**: credentials and commands are plaintext, enabling interception and session hijacking. Attackers can brute-force to gain shell, run remote commands, exfiltrate data, and pivot laterally, also threatening **availability** through misuse or takeover.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-telnet-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 23 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Telnet (port 23) from the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Telnet access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 23\n ToPort: 23\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0; restrict Telnet to trusted CIDR to remediate exposure\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Open the Inbound rules tab and find any rule allowing TCP port 23 from 0.0.0.0/0 or ::/0\n4. Delete the rule, or edit it to a specific trusted CIDR only\n5. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict Telnet (port 23) from the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 23\n to_port = 23\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do NOT use 0.0.0.0/0; restrict Telnet to trusted CIDR to fix the finding\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 23.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Eliminate Telnet: disable the service and block `TCP 23`.\n\nApply **least privilege** network access-restrict admin connectivity via **SSH** through bastion or **VPN**, keep management paths private, and segregate hosts. Use **defense in depth** with monitoring and strong authentication for any legacy needs.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_port_telnet_exposed_to_internet"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-11
@@ -1,32 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_profile_attached",
|
||||
"CheckTitle": "Ensure IAM instance roles are used for AWS resource access from instances",
|
||||
"CheckTitle": "EC2 instance is associated with an IAM instance profile role",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Ensure IAM instance roles are used for AWS resource access from instances.",
|
||||
"Risk": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS IAM roles reduce the risks associated with sharing and rotating credentials that can be used outside of AWS itself. If credentials are compromised, they can be used from outside of the AWS account.",
|
||||
"Description": "**EC2 instances** are evaluated for association with an **IAM instance profile role** that delivers temporary credentials to workloads running on the instance",
|
||||
"Risk": "Without an instance profile, apps often rely on long-term access keys on the host. Exposed keys can be used from anywhere to read data, alter resources, or disrupt services, impacting confidentiality, integrity, and availability. Keys may persist in AMIs, images, or logs, hindering rotation and amplifying blast radius.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/ec2-instance-using-iam-roles.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/ec2/attach_iam_roles_ec2_instances",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 associate-iam-instance-profile --instance-id <INSTANCE_ID> --iam-instance-profile Name=<INSTANCE_PROFILE_NAME>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: attach an IAM instance profile to the EC2 instance\nResources:\n ExampleInstance:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: <AMI_ID>\n InstanceType: <INSTANCE_TYPE>\n IamInstanceProfile: <INSTANCE_PROFILE_NAME> # Critical: associates an instance profile so the check passes\n```",
|
||||
"Other": "1. Open the AWS Management Console and go to EC2\n2. Select Instances and choose the target instance\n3. Click Actions > Security > Modify IAM role\n4. Select the IAM role (instance profile) to attach\n5. Click Update IAM role",
|
||||
"Terraform": "```hcl\n# Attach an IAM instance profile to the EC2 instance\nresource \"aws_instance\" \"example\" {\n ami = \"<AMI_ID>\"\n instance_type = \"<INSTANCE_TYPE>\"\n iam_instance_profile = \"<INSTANCE_PROFILE_NAME>\" # Critical: associates an instance profile so the check passes\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Create an IAM instance role if necessary and attach it to the corresponding EC2 instance..",
|
||||
"Url": "http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html"
|
||||
"Text": "Attach an **IAM instance profile** to every instance and grant only permissions each workload requires (**least privilege**). Eliminate static keys on hosts; use **temporary credentials** with automatic rotation. Separate roles per application, enforce **separation of duties**, and limit who can assign roles (govern via `iam:PassRole`). Monitor role usage for anomalies.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_profile_attached"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"identity-access"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+17
-11
@@ -1,29 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_public_ip",
|
||||
"CheckTitle": "Check for EC2 Instances with Public IP.",
|
||||
"CheckTitle": "EC2 instance does not have a public IP address",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "instance",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Check for EC2 Instances with Public IP.",
|
||||
"Risk": "Exposing an EC2 directly to internet increases the attack surface and therefore the risk of compromise.",
|
||||
"Description": "**EC2 instances** are assessed for the presence of a **public IPv4 address** and public DNS. A public IP indicates the instance is directly reachable from the Internet; no public IP implies access only through private networking paths such as load balancers, gateways, or proxies.",
|
||||
"Risk": "Publicly addressed instances are Internet-scannable, enabling direct probing and brute-force of exposed services and management ports. This increases risks of unauthorized access, remote code execution, and data exfiltration (**confidentiality, integrity**), and allows direct DDoS targeting, degrading **availability**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/aws-ec2-public-ip.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/public-policies/public_12#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/public-policies/public_12#aws-console",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/public-policies/public_12#terraform"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Launch EC2 without a public IP\nResources:\n ExampleInstance:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: <ami_id>\n InstanceType: <instance_type>\n NetworkInterfaces:\n - DeviceIndex: 0\n SubnetId: <example_subnet_id>\n AssociatePublicIpAddress: false # CRITICAL: ensures the instance has no public IPv4 address\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Instances and select the instance with a public IPv4 address\n2. Check the Networking tab to see if an Elastic IP is attached\n3. If an Elastic IP is attached:\n - Go to EC2 > Elastic IPs, select the address, choose Actions > Disassociate Elastic IP\n4. If the public IPv4 is auto-assigned (no Elastic IP shown):\n - Create a new instance (or an AMI from the current one) and, during launch, in Network settings, set Auto-assign public IP to Disable\n - Verify the new instance has no public IPv4, then migrate and terminate the old instance",
|
||||
"Terraform": "```hcl\n# Terraform: Launch EC2 without a public IP\nresource \"aws_instance\" \"example\" {\n ami = \"<ami_id>\"\n instance_type = \"<instance_type>\"\n subnet_id = \"<example_subnet_id>\"\n\n associate_public_ip_address = false # CRITICAL: ensures no public IPv4 is assigned\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use an ALB and apply WAF ACL.",
|
||||
"Url": "https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/"
|
||||
"Text": "Avoid assigning public IPs unless strictly required. Place workloads in private subnets and expose only via **load balancers** with **WAF**; use **bastions** or **Session Manager** for administration. Enforce **least privilege** security groups, prefer **private endpoints**, and route egress via **NAT** for **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_public_ip"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_secrets_user_data",
|
||||
"CheckTitle": "Find secrets in EC2 User Data.",
|
||||
"CheckTitle": "EC2 instance user data contains no secrets",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Sensitive Data Identifications/Security",
|
||||
"Sensitive Data Identifications/Passwords",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:access-analyzer:region:account-id:analyzer/resource-id",
|
||||
"Severity": "critical",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Find secrets in EC2 User Data.",
|
||||
"Risk": "Secrets hardcoded into instance user data can be used by malware and bad actors to gain lateral access to other services.",
|
||||
"Description": "**EC2 instance User Data** is inspected for **secret-like values** (credentials, tokens, keys). Both plain and compressed content are parsed, honoring configured exclusions, to identify patterns that resemble sensitive material within initialization scripts.",
|
||||
"Risk": "**Secrets embedded in User Data** undermine confidentiality and integrity. Anyone with instance or build-system access can read them, reuse credentials to call services, exfiltrate data, or move laterally. Exposure may persist in AMIs, snapshots, and backups, increasing blast radius over time.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000127092-ensure-no-secrets-are-found-in-ec2-user-data"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 describe-instance-attribute --attribute userData --region <REGION> --instance-id <INSTANCE_ID> --query UserData.Value --output text > encodeddata; base64 --decode encodeddata",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/secrets-policies/bc_aws_secrets_1#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/secrets-policies/bc_aws_secrets_1",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/secrets-policies/bc_aws_secrets_1#terraform"
|
||||
"CLI": "aws ec2 modify-instance-attribute --instance-id <INSTANCE_ID> --user-data \"Value=\"",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: EC2 instance with empty user data\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: <AMI_ID>\n InstanceType: t3.micro\n UserData: !Base64 \"\" # Critical: empty user data ensures no secrets are present\n```",
|
||||
"Other": "1. Open the AWS EC2 console and go to Instances\n2. Select the affected instance\n3. Click Actions > Instance settings > Edit user data\n4. Delete all contents of the user data field\n5. Click Save",
|
||||
"Terraform": "```hcl\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"<AMI_ID>\"\n instance_type = \"t3.micro\"\n user_data = \"\" # Critical: empty user data so no secrets are stored\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Implement automated detective control (e.g. using tools like Prowler) to scan accounts for passwords and secrets. Use secrets manager service to store and retrieve passwords and secrets.",
|
||||
"Url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"
|
||||
"Text": "Avoid placing secrets in User Data. Store them in a **managed secret service** and fetch at runtime via a **least-privilege instance role**. Prefer short-lived credentials with **regular rotation**. Limit who can view or edit User Data and apply **defense in depth** with automated secret scanning in build pipelines.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_secrets_user_data"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+17
-12
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_uses_single_eni",
|
||||
"CheckTitle": "Amazon EC2 instances should not use multiple ENIs",
|
||||
"CheckTitle": "EC2 instance has no more than one Elastic Network Interface (ENI) attached",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:instance/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "This control checks whether an EC2 instance uses multiple Elastic Network Interfaces (ENIs) or Elastic Fabric Adapters (EFAs). This control passes if a single network adapter is used. The control includes an optional parameter list to identify the allowed ENIs. This control also fails if an EC2 instance that belongs to an Amazon EKS cluster uses more than one ENI. If your EC2 instances need to have multiple ENIs as part of an Amazon EKS cluster, you can suppress those control findings.",
|
||||
"Risk": "Multiple ENIs can cause dual-homed instances, meaning instances that have multiple subnets. This can add network security complexity and introduce unintended network paths and access.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-multiple-eni-check.html",
|
||||
"Description": "**EC2 instances** are evaluated for attached network adapters. It identifies instances with more than one `ENI`-including `efa`, `interface`, or `trunk` types-and distinguishes those using a single adapter.",
|
||||
"Risk": "**Multiple ENIs** create dual-homed hosts across subnets and security groups, enabling unintended routing and policy bypass. Adversaries can pivot between segments, use alternate egress for **data exfiltration**, or exploit asymmetric paths, undermining segmentation and **confidentiality/integrity** while complicating containment.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#detach_eni",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-multiple-eni-check.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-17"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-17",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 detach-network-interface --attachment-id <ATTACHMENT_ID>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: ensure the instance has only one ENI\nResources:\n <example_resource_name>:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: <example_resource_id>\n InstanceType: t3.micro\n SubnetId: <example_resource_id> # FIX: creates a single primary ENI; do not add extra NetworkInterfaces/attachments\n```",
|
||||
"Other": "1. Open the AWS EC2 console and go to Network Interfaces\n2. Filter by the affected instance ID\n3. Select each non-primary network interface (Primary cannot be detached)\n4. Choose Actions > Detach\n5. Confirm the detach for each secondary ENI",
|
||||
"Terraform": "```hcl\n# Terraform: instance with only the primary ENI\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"<example_resource_id>\"\n instance_type = \"t3.micro\"\n subnet_id = \"<example_resource_id>\" # FIX: only primary ENI; no additional network_interface attachments\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "To detach a network interface from an EC2 instance, follow the instructions in the Amazon EC2 User Guide.",
|
||||
"Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#detach_eni"
|
||||
"Text": "Prefer a **single ENI per instance**.\n\nIf multi-homing is unavoidable:\n- Place ENIs in least-privilege subnets/SGs\n- Keep `source/destination check` enabled and routes explicit\n- Use gateways/LBs for NAT or ingress, not the host\n- Monitor flow logs and formally approve exceptions\n\nEmbed **defense in depth** and **zero trust**.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_uses_single_eni"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+23
-13
@@ -1,30 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_instance_with_outdated_ami",
|
||||
"CheckTitle": "Check for EC2 Instances Using Outdated AMIs",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "EC2 instance uses a non-deprecated Amazon AMI",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Patch Management",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:instance/resource-id",
|
||||
"Severity": "high",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2Instance",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "This check identifies EC2 instances using outdated Amazon Machine Images (AMIs) by auditing instances to gather AMI IDs, comparing them against the latest available versions, verifying suppo and security update status, and checking for deprecation.",
|
||||
"Risk": "Using outdated AMIs can expose EC2 instances to security vulnerabilities, lack of support, and missing critical updates, increasing the risk of exploitation.",
|
||||
"Description": "**EC2 instances** launched from **Amazon-owned AMIs** are evaluated for the AMI's `DeprecationTime`; instances tied to images with a deprecation date in the past are reported as using **deprecated AMIs**.",
|
||||
"Risk": "Running on a **deprecated AMI** undermines security and availability:\n- Missing patches enable exploitation of known CVEs (confidentiality/integrity)\n- Unsupported components hinder hardening and forensics\n- AMI removal from catalogs complicates scale-out and recovery (availability)",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-deprecate.html",
|
||||
"https://repost.aws/knowledge-center/ec2-find-deprecated-ami"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 describe-images --image-ids <ami-id>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://repost.aws/knowledge-center/ec2-find-deprecated-ami",
|
||||
"Terraform": ""
|
||||
"CLI": "",
|
||||
"NativeIaC": "```yaml\n# Use a non-deprecated Amazon AMI for instances launched via this template\nResources:\n <example_resource_name>:\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateData:\n ImageId: \"<non_deprecated_amazon_ami_id>\" # Critical: Amazon-owned AMI with no DeprecationTime\n```",
|
||||
"Other": "1. In the EC2 console, go to AMIs\n2. Set Owner to \"Amazon\" and ensure deprecated AMIs are not included; copy the AMI ID\n3. If using an Auto Scaling Group:\n - Launch templates > select the one in use > Create new version with Image ID set to the copied AMI and set it as default\n - Auto Scaling Groups > select the group > Start instance refresh\n4. If it is a standalone instance:\n - Launch a new instance using the copied Amazon AMI\n - Move workloads and terminate the old instance",
|
||||
"Terraform": "```hcl\n# EC2 instance using a non-deprecated Amazon AMI\nresource \"aws_instance\" \"<example_resource_name>\" {\n ami = \"<non_deprecated_amazon_ami_id>\" # Critical: Amazon-owned AMI with no DeprecationTime\n instance_type = \"t3.micro\"\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Regularly update your EC2 instances to use the latest AMIs to ensure they receive the latest security patches and updates.",
|
||||
"Url": "https://repost.aws/knowledge-center/ec2-find-deprecated-ami"
|
||||
"Text": "Adopt **non-deprecated, maintained AMIs** and perform rolling replacements of affected instances. Standardize on hardened golden images with **regular AMI rotation** and `DeprecationTime` monitoring. Update launch templates/ASGs to reference current images. Automate patching via an image pipeline and apply **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_instance_with_outdated_ami"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"vulnerabilities"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+24
-13
@@ -1,32 +1,43 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_launch_template_imdsv2_required",
|
||||
"CheckTitle": "Amazon EC2 launch templates should have IMDSv2 enabled and required.",
|
||||
"CheckTitle": "EC2 launch template has IMDSv2 enabled and required or instance metadata service disabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Credential Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:aws:ec2:region:account-id:launch-template/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2LaunchTemplate",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "This control checks if Amazon EC2 launch templates are configured with IMDSv2 enabled and required. The control fails if IMDSv2 is not enabled or required in the launch template versions.",
|
||||
"Risk": "Without IMDSv2 required, EC2 instances may be vulnerable to metadata service attacks, allowing unauthorized access to instance metadata, potentially leading to compromise of instance credentials or other sensitive data.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html",
|
||||
"Description": "EC2 launch templates are inspected for **Instance Metadata Service** configuration. It identifies versions where `http_endpoint` is `enabled` and `http_tokens` is `required` (IMDSv2 enforced), versions with the metadata service `disabled`, and versions that allow metadata without requiring tokens.",
|
||||
"Risk": "Allowing metadata access without **IMDSv2** enables SSRF and open proxy paths to query instance metadata, exposing temporary credentials and secrets. Attackers can steal IAM role credentials to access data, modify resources, and pivot within the account, threatening confidentiality and integrity.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-metadata-options",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-170"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 modify-launch-template --launch-template-id <template-id> --version <version-number> --metadata-options HttpTokens=required",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-170",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 create-launch-template-version --launch-template-id <example_resource_id> --source-version <example_source_version> --launch-template-data '{\"MetadataOptions\":{\"HttpTokens\":\"required\"}}'",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateName: <example_resource_name>\n LaunchTemplateData:\n MetadataOptions:\n HttpTokens: required # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Launch Templates\n2. Select the launch template, then choose Actions > Modify template (Create new version)\n3. Expand Advanced details > Metadata options\n4. Set Http tokens to Required (or disable Metadata accessible)\n5. Click Create template version\n6. (Optional) Set this new version as Default if you want it used for future launches",
|
||||
"Terraform": "```hcl\nresource \"aws_launch_template\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n\n metadata_options {\n http_tokens = \"required\" # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "To ensure EC2 launch templates have IMDSv2 enabled and required, update the template to configure the Instance Metadata Service Version 2 as required.",
|
||||
"Url": "https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-metadata-options"
|
||||
"Text": "Enforce **IMDSv2** in all launch template versions by setting token use to `required`; disable the metadata service when not needed. Apply **least privilege** to instance roles and use **defense in depth** (egress filtering, input validation) to reduce SSRF paths. Ensure applications and SDKs are compatible with IMDSv2.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_launch_template_imdsv2_required"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"secrets"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+23
-13
@@ -1,30 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_launch_template_no_public_ip",
|
||||
"CheckTitle": "Amazon EC2 launch templates should not assign public IPs to network interfaces.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "Amazon EC2 launch template has no public IP addresses configured on network interfaces",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2LaunchTemplate",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "This control checks if Amazon EC2 launch templates are configured to assign public IP addresses to network interfaces upon launch. The control fails if an EC2 launch template is configured to assign a public IP address to network interfaces or if there is at least one network interface that has a public IP address.",
|
||||
"Risk": "A public IP address is reachable from the internet, making associated resources potentially accessible from the internet. EC2 resources should not be publicly accessible to avoid unintended access to workloads.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-launch-template-public-ip-disabled.html",
|
||||
"Description": "**EC2 launch templates** with versions that either enable `associate_public_ip_address` for network interfaces or reference **ENIs** already associated with public IPs",
|
||||
"Risk": "Assigning **public IPs** makes instances Internet-reachable, enabling:\n- Loss of **confidentiality** via unauthorized access and data exfiltration\n- Compromised **integrity** through remote exploitation and tampering\n- Reduced **availability** from DDoS and brute-force traffic\nAttackers can scan exposed services and pivot within the VPC.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-network-interface",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-25",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/ec2-launch-template-public-ip-disabled.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-25",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 create-launch-template-version --launch-template-id <example_resource_id> --launch-template-data '{\"NetworkInterfaces\":[{\"DeviceIndex\":0,\"AssociatePublicIpAddress\":false}]}' --set-default-version",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Launch template configured to not assign public IPs\nResources:\n <example_resource_name>:\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateData:\n NetworkInterfaces:\n - DeviceIndex: 0\n AssociatePublicIpAddress: false # Critical: disables public IP assignment on the primary ENI\n```",
|
||||
"Other": "1. Open the EC2 console and go to Launch Templates\n2. Select the template and choose Actions > Create new version\n3. Under Network settings > Advanced network configuration, set Auto-assign public IP to Disable\n4. Ensure no Network interface is attached that already has a public IP\n5. Check Set as default version and choose Create launch template version",
|
||||
"Terraform": "```hcl\n# EC2 launch template configured to not assign public IPs\nresource \"aws_launch_template\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n\n network_interfaces {\n device_index = 0\n associate_public_ip_address = false # Critical: disables public IP assignment on the primary ENI\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "To update an EC2 launch template, see Change the default network interface settings in the Amazon EC2 Auto Scaling User Guide.",
|
||||
"Url": "https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-network-interface"
|
||||
"Text": "Apply **least privilege** and network segmentation:\n- Set `associate_public_ip_address=false` in launch templates\n- Avoid referencing ENIs with public IPs\n- Place instances in private subnets behind **NAT/ALB**\n- Use **Session Manager**, bastions, or **VPC endpoints/PrivateLink** for access\nAdopt **defense in depth** to minimize exposure.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_launch_template_no_public_ip"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+23
-12
@@ -1,27 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_launch_template_no_secrets",
|
||||
"CheckTitle": "Find secrets in EC2 Launch Template",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "EC2 launch template user data contains no secrets in any version",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Sensitive Data Identifications/Security",
|
||||
"Sensitive Data Identifications/Passwords",
|
||||
"Effects/Data Exposure",
|
||||
"TTPs/Credential Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:ec2:region:account-id:launch-template/template-id",
|
||||
"Severity": "critical",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2LaunchTemplate",
|
||||
"ResourceGroup": "compute",
|
||||
"Description": "Find secrets in EC2 Launch Template",
|
||||
"Risk": "The use of a hard-coded password increases the possibility of password guessing. If hard-coded passwords are used, it is possible that malicious users gain access through the account in question.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html",
|
||||
"Description": "**EC2 launch template** user data is analyzed across versions to identify embedded secrets-hard-coded passwords, tokens, API keys, or private keys-within the startup scripts or configuration supplied to instances.",
|
||||
"Risk": "Secrets in user data can be read by identities able to view launch templates, eroding confidentiality.\n\nExposed credentials enable unauthorized API actions, data exfiltration, and lateral movement. Past template versions retain leaked values, complicating rotation and recovery.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233727-ensure-no-secrets-are-hardcoded-in-ec2-launch-templates"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Launch Template without user data secrets\nResources:\n <example_resource_name>:\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateData:\n UserData: \"\" # Critical: empty user data ensures no secrets are stored in any new version\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Launch Templates\n2. Select the launch template and click Create new version\n3. In Advanced details, clear the User data field so it is blank\n4. Save and set this clean version as the Default version\n5. Back in the Versions tab, select all versions that contain secrets and click Actions > Delete versions\n6. Ensure only versions with blank (or non-secret) user data remain",
|
||||
"Terraform": "```hcl\n# Terraform: Launch Template with empty user data\nresource \"aws_launch_template\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n user_data = \"\" # Critical: empty user data prevents secrets from being stored\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Do not include sensitive information in user data within the launch templates, try to use Secrets Manager instead.",
|
||||
"Url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html"
|
||||
"Text": "Keep user data free of secrets. Retrieve sensitive values at runtime from **AWS Secrets Manager** or **SSM Parameter Store** `SecureString` using instance roles.\n\nEnforce **least privilege**, rotate to short-lived credentials, and review template history; if exposure occurred, rotate affected secrets.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_launch_template_no_secrets"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+22
-16
@@ -1,31 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_networkacl_allow_ingress_any_port",
|
||||
"CheckTitle": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to any port.",
|
||||
"CheckTitle": "Network ACL does not allow ingress from 0.0.0.0/0 to any port",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS AWS Foundations Benchmark"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "networkacl",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "medium",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2NetworkAcl",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to any port.",
|
||||
"Risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
|
||||
"Description": "**VPC network ACLs** with **inbound entries** that permit traffic from `0.0.0.0/0` to any port (any protocol) are identified at the subnet boundary.",
|
||||
"Risk": "Allowing Internet-wide ingress at the subnet layer enables broad port scanning and unsolicited connections. Attackers can probe and exploit exposed services, risking data disclosure and tampering (confidentiality, integrity) and causing outages via floods or brute-force (availability). Any security group lapse then lacks a compensating control.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233809-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-any-port"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 replace-network-acl-entry --network-acl-id <example_resource_id> --ingress --rule-number <RULE_NUMBER> --protocol -1 --rule-action deny --cidr-block 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: deny all inbound from the Internet on the NACL\nResources:\n NetworkAclDenyAllIngress:\n Type: AWS::EC2::NetworkAclEntry\n Properties:\n NetworkAclId: \"<example_resource_id>\"\n RuleNumber: 100\n Protocol: -1\n Egress: false\n RuleAction: deny # CRITICAL: Denies ingress\n CidrBlock: 0.0.0.0/0 # CRITICAL: From the Internet (any IP)\n```",
|
||||
"Other": "1. In AWS Console, go to VPC > Network ACLs\n2. Select the NACL used by the affected subnet\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule that allows 0.0.0.0/0 to all ports and change Action to Deny (or delete the allow-all rule)\n5. Save changes",
|
||||
"Terraform": "```hcl\n# Deny all inbound from the Internet on the NACL\nresource \"aws_network_acl_rule\" \"<example_resource_name>\" {\n network_acl_id = \"<example_resource_id>\"\n rule_number = 100\n egress = false\n protocol = \"-1\"\n rule_action = \"deny\" # CRITICAL: Denies ingress\n cidr_block = \"0.0.0.0/0\" # CRITICAL: From the Internet (any IP)\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
|
||||
"Text": "Adopt a **deny-by-default** NACL posture: block `0.0.0.0/0` and allow only required ports from trusted CIDRs. Apply **least privilege** using security groups for fine-grained access, with NACLs as coarse stateless filters. Review and prune rules regularly, and employ **defense in depth** with monitoring and alerting.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_networkacl_allow_ingress_any_port"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
@@ -33,5 +39,5 @@
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": "Infrastructure Security"
|
||||
"Notes": ""
|
||||
}
|
||||
|
||||
+17
-12
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_networkacl_allow_ingress_tcp_port_22",
|
||||
"CheckTitle": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to SSH port 22",
|
||||
"CheckTitle": "Network ACL does not allow ingress from the Internet to TCP port 22 (SSH)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "networkacl",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2NetworkAcl",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to SSH port 22",
|
||||
"Risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
|
||||
"Description": "**VPC network ACLs** are evaluated for inbound rules that permit `0.0.0.0/0` to access **SSH** on `TCP 22` at the subnet boundary.",
|
||||
"Risk": "An ACL allowing Internet-wide SSH erodes **defense in depth**. Systems reachable on `TCP 22` face **brute-force**, credential stuffing, reconnaissance, and SSH exploit attempts.\n\nChanges to routes or security groups can create direct exposure, enabling unauthorized access and **lateral movement**, undermining **confidentiality** and **integrity**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233578-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-ssh-port-22",
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-22#cloudformation",
|
||||
"Other": "",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-22#terraform"
|
||||
"CLI": "aws ec2 replace-network-acl-entry --network-acl-id <NETWORK_ACL_ID> --ingress --rule-number <RULE_NUMBER> --protocol 6 --rule-action deny --cidr-block 0.0.0.0/0 --port-range From=22,To=22",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Deny SSH (22) from Internet on the NACL\nResources:\n <example_resource_name>:\n Type: AWS::EC2::NetworkAclEntry\n Properties:\n NetworkAclId: <example_resource_id>\n RuleNumber: 1\n Protocol: 6\n RuleAction: deny # Critical: blocks the traffic instead of allowing it\n Egress: false\n CidrBlock: 0.0.0.0/0 # Critical: matches Internet sources\n PortRange:\n From: 22 # Critical: SSH port\n To: 22\n```",
|
||||
"Other": "1. In AWS Console, go to VPC > Network ACLs\n2. Select <example_resource_name> and open the Inbound rules tab\n3. Delete any rule that ALLOWS TCP port 22 from 0.0.0.0/0 or ::/0\n4. Save changes\n5. If you cannot delete it, edit the rule and set Action to Deny for TCP port 22 with source 0.0.0.0/0 (and ::/0 if present), then save",
|
||||
"Terraform": "```hcl\n# Deny SSH (22) from Internet on the NACL\nresource \"aws_network_acl_rule\" \"<example_resource_name>\" {\n network_acl_id = \"<example_resource_id>\"\n rule_number = 1\n egress = false\n protocol = \"tcp\"\n rule_action = \"deny\" # Critical: blocks SSH ingress\n cidr_block = \"0.0.0.0/0\" # Critical: Internet sources\n from_port = 22 # Critical: SSH port\n to_port = 22\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
|
||||
"Text": "Apply **least privilege** at the subnet layer:\n- Do not allow `0.0.0.0/0` to `TCP 22`\n- Restrict SSH to trusted sources, or avoid direct SSH via **Session Manager** or a bastion behind **VPN**\n\nPair tight **security groups** with periodic rule reviews and change control to maintain **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_networkacl_allow_ingress_tcp_port_22"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_networkacl_allow_ingress_tcp_port_3389",
|
||||
"CheckTitle": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to Microsoft RDP port 3389",
|
||||
"CheckTitle": "Network ACL does not allow ingress from the Internet to TCP port 3389 (RDP)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "networkacl",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2NetworkAcl",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to Microsoft RDP port 3389",
|
||||
"Risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
|
||||
"Description": "**VPC network ACLs** with inbound rules allowing **RDP** on `TCP 3389` from `0.0.0.0/0` are identified.\n\nAssessment focuses on subnet-level ACL entries that permit this traffic.",
|
||||
"Risk": "Internet-exposed **RDP** enables **password spraying**, brute force, and exploitation of RDP flaws to gain remote control. Allowing it at the subnet layer weakens **defense in depth**-a misconfigured security group or route can expose instances-leading to data exfiltration, privilege escalation, and ransomware, impacting confidentiality and integrity.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://support.icompaas.com/support/solutions/articles/62000223179-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-microsoft-rdp-port-3389-",
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-3389#cloudformation",
|
||||
"Other": "",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-3389#terraform"
|
||||
"CLI": "aws ec2 delete-network-acl-entry --network-acl-id <NETWORK_ACL_ID> --ingress --rule-number <RULE_NUMBER>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: deny inbound RDP (TCP 3389) from the Internet on an existing NACL\nResources:\n NetworkAclDenyRDP:\n Type: AWS::EC2::NetworkAclEntry\n Properties:\n NetworkAclId: <example_resource_id>\n RuleNumber: 1 # Critical: ensure this deny is evaluated before any allow\n Protocol: 6 # TCP\n Egress: false # Ingress rule\n RuleAction: deny # Critical: block the traffic\n CidrBlock: 0.0.0.0/0 # Critical: Internet source\n PortRange:\n From: 3389 # Critical: RDP port\n To: 3389\n```",
|
||||
"Other": "1. In the AWS Console, go to VPC > Network ACLs and select the ACL used by the affected subnet(s)\n2. Open the Inbound rules tab\n3. Find any rule allowing TCP port 3389 (RDP) from 0.0.0.0/0 or ::/0\n4. Select that rule and click Delete, then Save\n5. If you must keep broad allows, instead click Edit inbound rules and add a new rule with a lower rule number that Denies TCP 3389 from 0.0.0.0/0, then Save",
|
||||
"Terraform": "```hcl\n# Deny inbound RDP (TCP 3389) from the Internet on an existing NACL\nresource \"aws_network_acl_rule\" \"<example_resource_name>\" {\n network_acl_id = \"<example_resource_id>\"\n rule_number = 1 # Critical: lower than any allow so deny takes precedence\n egress = false # Ingress rule\n protocol = \"tcp\"\n rule_action = \"deny\" # Critical: block the traffic\n cidr_block = \"0.0.0.0/0\" # Critical: Internet source\n from_port = 3389 # Critical: RDP port\n to_port = 3389\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
|
||||
"Text": "Enforce **least privilege**: do not allow `TCP 3389` from `0.0.0.0/0` in network ACLs.\n\n- Restrict RDP to specific admin IP ranges\n- Prefer **bastion hosts** or **Session Manager** over direct RDP\n- Use private subnets and layer controls for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_networkacl_allow_ingress_tcp_port_3389"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-13
@@ -1,33 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_networkacl_unused",
|
||||
"CheckTitle": "Unused Network Access Control Lists should be removed.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "Non-default network ACL is associated with a subnet",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsEc2NetworkAcl",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure that there are no unused network access control lists (network ACLs) in your virtual private cloud (VPC). The control fails if the network ACL isn't associated with a subnet. The control doesn't generate findings for an unused default network ACL.",
|
||||
"Risk": "Unused network ACLs may represent a potential security risk if left in place without purpose, as they could be mistakenly associated with subnets later.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/vpc-network-acl-unused-check.html",
|
||||
"Description": "**VPC network ACLs** that are **not associated with any subnet** are considered unused. The evaluation focuses on non-default ACLs and identifies those without a current subnet association; the default network ACL is excluded.",
|
||||
"Risk": "Unused ACLs raise the risk of **misassociation**, unexpectedly changing subnet filtering. A permissive ACL could expose workloads (**confidentiality, integrity**), while an overly restrictive one could disrupt traffic (**availability**). Stale objects also hinder reviews and conceal drift.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#vpc-network-acl-delete",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-16",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/vpc-network-acl-unused-check.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 delete-network-acl --network-acl-id <nacl_id>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-16",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# Associate the unused non-default NACL to a subnet so it's in use\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SubnetNetworkAclAssociation\n Properties:\n SubnetId: <example_resource_id> # Critical: makes the subnet use this NACL\n NetworkAclId: <example_resource_id> # Critical: the unused non-default NACL to associate\n```",
|
||||
"Other": "1. In the AWS console, open VPC > Network ACLs\n2. Select the non-default NACL with Association: None\n3. Choose Actions > Delete ACL > Delete\n\nAlternative (if you want to keep it):\n1. Select the NACL > Actions > Edit subnet associations\n2. Check a subnet to associate > Save",
|
||||
"Terraform": "```hcl\n# Associate the unused non-default NACL to a subnet so it's in use\nresource \"aws_network_acl_association\" \"<example_resource_name>\" {\n subnet_id = \"<example_resource_id>\" # Critical: makes the subnet use this NACL\n network_acl_id = \"<example_resource_id>\" # Critical: the unused non-default NACL to associate\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "For instructions on deleting an unused network ACL, see Deleting a network ACL in the Amazon VPC User Guide.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#vpc-network-acl-delete"
|
||||
"Text": "Remove **unused non-default ACLs** to minimize drift. Apply **least privilege** and **change control** to ACL creation and associations. If retention is necessary, tag owner and purpose, restrict who can associate ACLs, and review regularly as part of **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_networkacl_unused"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": "Infrastructure Security"
|
||||
"Notes": ""
|
||||
}
|
||||
|
||||
+19
-11
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to all ports.",
|
||||
"CheckTitle": "Security group does not have all ports open to the Internet",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to all ports.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased. An attacker could exploit this misconfiguration to gain unauthorized access to resources.",
|
||||
"Description": "**EC2 security groups** with **inbound rules** permitting Internet sources (`0.0.0.0/0`, `::/0`) to `all ports` across any protocol",
|
||||
"Risk": "Opening every port to the Internet enables broad scanning and exploit attempts, leading to **unauthorized access**, **remote code execution**, and **data exfiltration**, with easier lateral movement into the VPC. Confidentiality, integrity, and availability are all at risk.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-ingress-any.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports/"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Security Group without an inbound rule that opens all ports to the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Example SG\n VpcId: <example_resource_id>\n # Critical: Omit SecurityGroupIngress to ensure no rule with IpProtocol \"-1\" from 0.0.0.0/0 or ::/0 exists,\n # which prevents all ports from being open to the Internet.\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Delete any rule where Type is All traffic (protocol = All) with Source 0.0.0.0/0 or ::/0\n5. Click Save rules",
|
||||
"Terraform": "```hcl\n# Security Group with no inbound rules (prevents all ports open to the Internet)\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n # Critical: no ingress blocks; avoids any rule with protocol \"-1\" from 0.0.0.0/0 or ::/0\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Enforce **least privilege** on ingress: allow only required ports from trusted sources, avoid `0.0.0.0/0` and `::/0`. Prefer private access (VPN, bastion, or Session Manager), use security group references, and layer **defense in depth** with network ACLs. Periodically review and remove unused rules.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_all_ports"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_any_port",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to any port.",
|
||||
"CheckTitle": "Security group has no 0.0.0.0/0 or ::/0 ingress to any port, or is attached only to allowed interface types or instance owners",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to any port and not attached to a network interface with not allowed network interface types or instance owners. By default, the allowed network interface types are 'api_gateway_managed' and 'vpc_endpoint', and the allowed instance owners are 'amazon-elb', you can customize these values by setting the 'ec2_allowed_interface_types' and 'ec2_allowed_instance_owners' variables.",
|
||||
"Risk": "The security group allows all traffic from the internet to any port. This could allow an attacker to access the instance.",
|
||||
"Description": "**EC2 security groups** with **internet-sourced ingress** from `0.0.0.0/0` or `::/0` to any port, and their attachments, are evaluated. Groups linked to network interfaces or instance owners outside an approved list for public exposure are identified.",
|
||||
"Risk": "Open ingress to any port on non-approved interfaces enables external scanning, brute force, and exploitation of unintended services. This threatens **confidentiality** (unauthorized access), **integrity** (tampering), and **availability** (DoS), and facilitates **lateral movement**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000234274-5-3-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-to-remote-server-administration-ports-aut"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: security group without Internet-open ingress\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"SG without Internet ingress\"\n VpcId: \"<example_resource_id>\"\n SecurityGroupIngress: [] # Critical: no 0.0.0.0/0 or ::/0 inbound; denies all inbound\n```",
|
||||
"Other": "1. In the AWS console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open Inbound rules > Edit inbound rules\n4. Delete any rule with Source 0.0.0.0/0 or ::/0\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Security group with no Internet-open ingress\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n # Critical: no ingress blocks -> prevents 0.0.0.0/0 or ::/0 inbound\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege**: restrict ingress to required ports and trusted sources; avoid `0.0.0.0/0` and `::/0` except for managed public endpoints. Place workloads behind **load balancers**, **API gateways**, or **WAFs**; use **private networking**. Allow public rules only on approved interface types.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_any_port"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to high risk ports.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to high-risk TCP ports",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/Unauthorized Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "critical",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to ports 25(SMTP), 110(POP3), 135(RCP), 143(IMAP), 445(CIFS), 3000(Go, Node.js, and Ruby web developemnt frameworks), 4333(ahsp), 5000(Python web development frameworks), 5500(fcp-addr-srvr1), 8080(proxy), 8088(legacy HTTP port).",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are assessed for inbound rules that allow Internet sources (`0.0.0.0/0` or `::/0`) to **high-risk TCP ports**: `25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088`.\n\nFindings highlight groups exposing any of these ports to the public network.",
|
||||
"Risk": "Public exposure of these ports enables:\n- **RCE** via SMB/RPC and weak admin consoles (`445`, `135`, `3000`, `5000`, `8080`)\n- **Credential theft/data leakage** via mail protocols (`25`, `110`, `143`)\n- **Spam relay** on `25`\nImpacts: **confidentiality**, **integrity**, and **availability** through exploitation and mass scanning.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000234274-5-3-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-to-remote-server-administration-ports-aut"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict high-risk TCP port from Internet\nResources:\n ExampleSecurityGroup:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict high-risk TCP port\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 8080\n ToPort: 8080\n CidrIp: 10.0.0.0/8 # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict source to non-Internet to pass the check\n```",
|
||||
"Other": "1. In the AWS console, go to EC2 > Network & Security > Security Groups\n2. Select the security group in the finding and click Inbound rules > Edit inbound rules\n3. For each high-risk TCP port (25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088) with Source 0.0.0.0/0 or ::/0, delete the rule or change Source to a specific trusted CIDR (for example, your VPC CIDR)\n4. Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: restrict high-risk TCP port from Internet\nresource \"aws_security_group\" \"example\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 8080\n to_port = 8080\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict source to non-Internet to pass the check\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict these ports using **least privilege**:\n- Deny Internet ingress; allow only trusted CIDRs or private connectivity\n- Place services behind **VPN**, **bastion**, or **proxies/WAF**; prefer **private endpoints**\n- Disable unnecessary services; require auth and TLS on exposed apps\nApply **defense in depth** with security groups and network ACLs.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to SSH port 22.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 22 (SSH)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/Unauthorized Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to SSH port 22.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are assessed for **inbound SSH exposure** by locating ingress rules that allow `TCP 22` from the Internet (`0.0.0.0/0` or `::/0`).\n\nOnly groups in use are considered; sets already flagged for all-port exposure are not repeated.",
|
||||
"Risk": "Exposed **SSH** invites Internet-scale **brute force** and **credential stuffing**. A successful login grants **remote shell**, enabling data theft (confidentiality), code or config tampering (integrity), and cryptomining or service disruption (availability), plus **lateral movement** within the environment.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ssh-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <GROUP_ID> --protocol tcp --port 22 --cidr",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/networking_1-port-security#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_1-port-security",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_1-port-security#terraform"
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 22 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict SSH from the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SSH\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 22\n ToPort: 22\n CidrIp: 10.0.0.0/8 # Critical: allows SSH only from a private range, not 0.0.0.0/0\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab\n4. Delete any rule for port 22 (SSH) with source 0.0.0.0/0 or ::/0\n5. Click Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: restrict SSH from the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 22\n to_port = 22\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do not use 0.0.0.0/0 or ::/0\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** to SSH:\n- Disallow `0.0.0.0/0` and `::/0`; allow only trusted IPs or VPN ranges\n- Prefer **private access** via bastion hosts or AWS Systems Manager Session Manager\n- Enforce **key-based auth**, disable passwords, rotate keys\n- Add **network segmentation** and monitoring for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 3389.",
|
||||
"CheckTitle": "Security group does not allow ingress from the Internet to TCP port 3389 (RDP)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 3389.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** restrict **inbound RDP** on `TCP 3389` to trusted sources, avoiding Internet-wide (`0.0.0.0/0`, `::/0`) exposure.",
|
||||
"Risk": "**Internet-exposed RDP** enables brute force and credential stuffing and increases the chance of **remote code execution** via RDP flaws.\n\nAdversaries can gain interactive access, exfiltrate data (**confidentiality**), tamper with systems (**integrity**), and trigger ransomware or service disruption (**availability**).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-rdp-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <GROUP_ID> --protocol tcp --port 3389 --cidr",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/networking_2#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_2",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_2#terraform"
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 3389 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict RDP (3389) from the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict RDP\n VpcId: vpc-<example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3389\n ToPort: 3389\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0; limits RDP to internal range, closing Internet access\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. In the Inbound rules tab, click Edit inbound rules\n4. Find any rule with Type RDP (TCP 3389) and Source 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific trusted CIDR (e.g., your office IP)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict RDP (3389) from the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 3389\n to_port = 3389\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: not 0.0.0.0/0; restricts RDP to internal range\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege**: disallow `0.0.0.0/0` and `::/0` to `3389`; permit only specific IPs or private networks.\n\nPrefer **Session Manager**, VPN, or a hardened bastion with MFA and just-in-time access. Use private subnets and add **defense in depth** with network controls and monitoring.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Cassandra ports 7199 or 9160 or 8888.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Cassandra TCP ports 7199, 9160, or 8888",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Cassandra ports 7199 or 9160 or 8888.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are evaluated for inbound rules that allow the Internet (`0.0.0.0/0` or `::/0`) to reach **Cassandra ports** `7199`, `9160`, or `8888`.\n\nFocuses on `tcp` rules that expose these ports to public sources.",
|
||||
"Risk": "Exposed **Cassandra interfaces** (`7199` JMX, `9160` Thrift, `8888` tools) enable:\n- Unauthorized reads of data/metrics (confidentiality)\n- Schema and cluster changes (integrity)\n- Remote operations causing outages (availability)\n\nPublic reachability also increases brute-force and exploit attempts.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000127020-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-cassandra-ports-7199-or-9160-or-88"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions IpProtocol=tcp,FromPort=7199,ToPort=7199,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]' IpProtocol=tcp,FromPort=9160,ToPort=9160,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]' IpProtocol=tcp,FromPort=8888,ToPort=8888,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Cassandra ports from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Cassandra ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 7199\n ToPort: 7199\n CidrIp: 10.0.0.0/16 # Critical: not 0.0.0.0/0; restricts IPv4 source\n - IpProtocol: tcp\n FromPort: 9160\n ToPort: 9160\n CidrIp: 10.0.0.0/16 # Critical: not 0.0.0.0/0; restricts IPv4 source\n - IpProtocol: tcp\n FromPort: 8888\n ToPort: 8888\n CidrIp: 10.0.0.0/16 # Critical: not 0.0.0.0/0; restricts IPv4 source\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. In Inbound rules, delete any rule allowing TCP 7199, 9160, or 8888 from 0.0.0.0/0 or ::/0\n4. If needed, add new rules for these ports limited to specific trusted CIDR(s)\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Restrict Cassandra ports from Internet\nresource \"aws_security_group\" \"example\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 7199\n to_port = 7199\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # Critical: not 0.0.0.0/0; restricts IPv4 source\n }\n ingress {\n from_port = 9160\n to_port = 9160\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # Critical: not 0.0.0.0/0; restricts IPv4 source\n }\n ingress {\n from_port = 8888\n to_port = 8888\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # Critical: not 0.0.0.0/0; restricts IPv4 source\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict **ingress** on `7199`, `9160`, `8888` to trusted sources:\n- Enforce **least privilege** allow-lists; avoid `0.0.0.0/0` and `::/0`\n- Place nodes in private subnets; use VPN or a bastion for admin\n- Prefer strong auth and *mTLS*; bind management to internal interfaces\n- Apply **defense in depth** with segmentation (north-south and east-west)",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-12
@@ -1,29 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana ports.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana TCP ports 9200, 9300, and 5601",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana ports.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** restrict public ingress to Elasticsearch/Kibana ports `9200`, `9300`, and `5601`, denying sources `0.0.0.0/0` and `::/0`",
|
||||
"Risk": "Open Elasticsearch/Kibana ports to the Internet erode CIA:\n- Confidentiality: unauthorized queries and data exfiltration\n- Integrity: index tampering/deletion, cluster control via `9300`\n- Availability: API abuse, exploit-based outages, and Kibana `5601` brute-force",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233821-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-elasticsearch-and-kibana-ports-tcp-9200-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":9200,\"ToPort\":9200,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9300,\"ToPort\":9300,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":5601,\"ToPort\":5601,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Elasticsearch/Kibana ports from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Block Internet access to 9200, 9300, 5601\n VpcId: vpc-<example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9200\n ToPort: 9200\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0 or ::/0; restricts 9200 to trusted CIDR\n - IpProtocol: tcp\n FromPort: 9300\n ToPort: 9300\n CidrIp: 10.0.0.0/8 # CRITICAL: restricts 9300 from Internet\n - IpProtocol: tcp\n FromPort: 5601\n ToPort: 5601\n CidrIp: 10.0.0.0/8 # CRITICAL: restricts 5601 (Kibana) from Internet\n```",
|
||||
"Other": "1. Open the AWS Console and go to VPC > Security Groups\n2. Select the affected security group\n3. Choose Inbound rules > Edit inbound rules\n4. For ports 9200, 9300, and 5601, remove any rule with Source 0.0.0.0/0 or ::/0\n5. If access is required, add rules for only trusted CIDR(s) instead\n6. Save rules",
|
||||
"Terraform": "```hcl\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n # CRITICAL: Do not use 0.0.0.0/0 or ::/0; restrict these ports to trusted CIDRs\n ingress {\n from_port = 9200\n to_port = 9200\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restricts 9200 from Internet\n }\n ingress {\n from_port = 9300\n to_port = 9300\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restricts 9300 from Internet\n }\n ingress {\n from_port = 5601\n to_port = 5601\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restricts 5601 (Kibana) from Internet\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Limit ingress to `9200`, `9300`, and `5601` to trusted CIDRs or private connectivity; never allow `0.0.0.0/0` or `::/0`. Prefer **private access** via VPN, bastion, or private endpoints. Apply **least privilege**, network segmentation, and **defense in depth** (NACLs/WAF). Require strong auth and TLS on Elasticsearch/Kibana.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-16
@@ -1,32 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21.",
|
||||
"CheckAliases": [
|
||||
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21"
|
||||
],
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "EC2 security groups are evaluated for Internet-exposed **FTP**: any inbound rule allowing `tcp` ports `20` or `21` from `0.0.0.0/0` or `::/0`.",
|
||||
"Risk": "Exposed FTP weakens CIA:\n- Confidentiality: cleartext credentials/files enable interception and brute force.\n- Integrity: unauthorized uploads or tampering enable malware staging.\n- Availability: mass scans and login attempts can exhaust resources and disrupt services.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ftp-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":20,\"ToPort\":20,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":21,\"ToPort\":21,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict FTP (20,21) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict FTP from Internet\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 20\n ToPort: 20\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0; limits IPv4 to a private range\n - IpProtocol: tcp\n FromPort: 21\n ToPort: 21\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0; limits IPv4 to a private range\n```",
|
||||
"Other": "1. Open the AWS Console and go to EC2 > Security Groups\n2. Select the security group attached to the affected resource\n3. In Inbound rules, find any rules for TCP ports 20 or 21 with Source 0.0.0.0/0 or ::/0\n4. Delete those rules (or edit them to a specific trusted CIDR only)\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: restrict FTP (20,21) from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 20\n to_port = 20\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0; restricts IPv4\n }\n\n ingress {\n from_port = 21\n to_port = 21\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0; restricts IPv4\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** and **defense in depth**:\n- Remove `0.0.0.0/0` and `::/0` to `20`/`21`; allow only trusted IPs or private access (VPN/peering).\n- Prefer **SFTP/FTPS** or HTTPS; disable anonymous FTP.\n- Segment transfer hosts, monitor access, and enforce rate limits and strong authentication.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
@@ -34,5 +36,8 @@
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
"Notes": "",
|
||||
"CheckAliases": [
|
||||
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21"
|
||||
]
|
||||
}
|
||||
|
||||
+19
-12
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Kafka port 9092.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 9092 (Kafka)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Kafka port 9092.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are evaluated for ingress rules that expose **Kafka** on `TCP 9092` to the Internet via `0.0.0.0/0` or `::/0`",
|
||||
"Risk": "Public Kafka `9092` access allows arbitrary clients to connect, enabling topic enumeration, data exfiltration, and producer/consumer impersonation (**C/I**). Brokers can be flooded or exploited, disrupting clusters (**A**). Exposure gives attackers a foothold for lateral movement inside the VPC.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233725-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-kafka-port-9092-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":9092,\"ToPort\":9092,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Kafka (9092) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Kafka 9092\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9092\n ToPort: 9092\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0; restricts access to private range to avoid Internet exposure\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the group attached to the resource\n3. Inbound rules > Edit inbound rules\n4. Find any rule for TCP port 9092 with Source 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific trusted CIDR or security group\n6. Save rules",
|
||||
"Terraform": "```hcl\n# Restrict Kafka (9092) from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 9092\n to_port = 9092\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0; restricts access to avoid Internet exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege**: restrict `9092` to required subnets or IPs; avoid `0.0.0.0/0` and `::/0`. Place brokers on private networks and use peering or VPN for access. Enforce **mutual TLS/SASL** and topic ACLs, and add **defense in depth** with segmentation and NACLs.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Memcached port 11211.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Memcached TCP port 11211",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Memcached port 11211.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are evaluated for inbound rules that permit Internet-sourced access to `TCP 11211` (Memcached) from `0.0.0.0/0` or `::/0`.",
|
||||
"Risk": "Exposed **Memcached** enables unauthenticated access, impacting CIA:\n- **Confidentiality**: read cached data (sessions, secrets)\n- **Integrity**: modify or poison entries\n- **Availability**: flush or overload cache, degrading apps\n\nOpen `11211` is widely scanned, enabling unauthorized access and lateral movement.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000127021-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-memcached-port-11211"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Memcached (11211) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Memcached access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 11211\n ToPort: 11211\n CidrIp: 10.0.0.0/8 # FIX: Not 0.0.0.0/0; limits access so 11211 isn't open to the Internet\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group and open the Inbound rules tab\n3. Click Edit inbound rules\n4. Delete any rule allowing TCP 11211 from 0.0.0.0/0 or ::/0, or change its Source to a specific trusted CIDR\n5. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict Memcached (11211) from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 11211\n to_port = 11211\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: avoid 0.0.0.0/0 to prevent Internet exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** and **segmentation**:\n- Restrict `TCP 11211` to trusted CIDRs or security groups\n- Keep Memcached on private subnets; avoid public IPs\n- Add **defense in depth** with NACLs/firewalls; disable unused protocols\n- Use private connectivity (VPN/peering) and monitor access",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+22
-16
@@ -1,32 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018.",
|
||||
"CheckAliases": [
|
||||
"ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018"
|
||||
],
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MongoDB TCP ports 27017 and 27018",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are inspected for inbound rules that expose **MongoDB** on `TCP 27017-27018` to the Internet via `0.0.0.0/0` or `::/0`.\n\nIt identifies groups where these ports are reachable from any address.",
|
||||
"Risk": "Public **MongoDB** ports invite unauthenticated probing, brute force, and misuse of weak configs. Attackers can read/alter data, drop collections, or deploy ransomware, compromising **confidentiality** and **integrity**.\n\nExposure also enables enumeration and lateral movement, threatening **availability**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000127019-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-mongodb-ports-27017-and-27018"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":27017,\"ToPort\":27018,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict MongoDB ports from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict MongoDB ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 27017\n ToPort: 27018\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0 or ::/0; limits access to internal range\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to your resource\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find rules for TCP ports 27017 or 27018 with Source 0.0.0.0/0 or ::/0\n5. Delete those rules or change Source to a specific trusted CIDR (e.g., 10.0.0.0/8)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict MongoDB ports from Internet\nresource \"aws_security_group\" \"secure\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 27017\n to_port = 27018\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: not 0.0.0.0/0 or ::/0; restricts Internet access\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** to MongoDB access:\n- Block `0.0.0.0/0` and `::/0`\n- Allow only trusted IPs or private networks\n- Prefer private connectivity and SG-to-SG references\n- Enforce authentication and TLS\n- Segment east-west traffic and monitor access for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
@@ -34,5 +37,8 @@
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
"Notes": "",
|
||||
"CheckAliases": [
|
||||
"ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018"
|
||||
]
|
||||
}
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroups",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are assessed for **inbound exposure** of **MySQL** on `TCP 3306` from `0.0.0.0/0` or `::/0`.\n\nThe finding reflects whether this port is reachable from any IPv4 or IPv6 address.",
|
||||
"Risk": "**Public MySQL** access lets anyone reach the service, enabling credential brute force and vulnerability exploitation. This threatens:\n- **Confidentiality**: data exfiltration\n- **Integrity**: unauthorized writes or schema changes\n- **Availability**: DoS from abuse or scans",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-mysql-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict MySQL (3306) from Internet\nResources:\n ExampleSecurityGroup:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Limit MySQL access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3306\n ToPort: 3306\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0 or ::/0; limits MySQL to internal range\n```",
|
||||
"Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group in use by the instance\n3. In Inbound rules, click Edit inbound rules\n4. Remove any rule for TCP port 3306 with source 0.0.0.0/0 or ::/0\n5. Add a rule for TCP 3306 only from a trusted source (e.g., specific IP/CIDR or a security group)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict MySQL (3306) from Internet\nresource \"aws_security_group\" \"example_resource_name\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 3306\n to_port = 3306\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0 or ::/0; restricts MySQL access\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege**: restrict `3306` to specific sources or peer security groups only. Keep databases in private subnets and use **VPN**, **bastion**, or application proxies for admin access. Enable **defense in depth** with TLS and strong auth. Never allow `0.0.0.0/0` or `::/0` ingress.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+16
-11
@@ -1,29 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Oracle ports 1521 or 2483.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Oracle TCP ports 1521 or 2483",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Oracle ports 1521 or 2483.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are evaluated for inbound rules that permit public sources (`0.0.0.0/0` or `::/0`) to `TCP 1521` or `TCP 2483`-Oracle listener ports.\n\nThe focus is on rules that make these ports reachable from the Internet over IPv4 or IPv6.",
|
||||
"Risk": "Public Oracle listener exposure enables attackers to:\n- **Brute force** credentials and enumerate services\n- Exploit **listener flaws** for remote access\n- Run unauthorized queries causing **data exfiltration**\n- Launch **DoS** on the listener\n\nThis jeopardizes database confidentiality, integrity, and availability.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000236318-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-oracle-ports-1521-or-2483-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Oracle ports 1521 and 2483 from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Oracle ports from Internet\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1521\n ToPort: 1521\n CidrIp: 10.0.0.0/8 # Critical: do not use 0.0.0.0/0; restrict source to internal range to block Internet\n - IpProtocol: tcp\n FromPort: 2483\n ToPort: 2483\n CidrIp: 10.0.0.0/8 # Critical: restrict Oracle port 2483 from Internet\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the resource\n3. Open the Inbound rules tab and click Edit inbound rules\n4. For rules on TCP ports 1521 or 2483 with Source 0.0.0.0/0 or ::/0, delete them or change Source to a specific trusted CIDR (e.g., your internal range)\n5. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict Oracle ports 1521 and 2483 from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 1521\n to_port = 1521\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do not use 0.0.0.0/0; restrict to internal range\n }\n\n ingress {\n from_port = 2483\n to_port = 2483\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: restrict Oracle port 2483 from Internet\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** and **defense in depth**: disallow public ingress to `TCP 1521` and `TCP 2483`.\n\nRestrict access to trusted CIDRs or peer security groups, keep databases on private networks, and require **VPN**, **bastion**, or **proxy** access. Enforce **TLS** and segment east-west and north-south traffic.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Postgres port 5432.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Postgres TCP port 5432",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Postgres port 5432.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are evaluated for inbound rules that expose **Postgres** on `TCP 5432` to the Internet. Rules permitting `0.0.0.0/0` or `::/0` to this port, or policies that open all ports publicly, are identified.",
|
||||
"Risk": "Exposing `5432` to the Internet enables credential stuffing and Postgres exploits, risking data disclosure (**confidentiality**), unauthorized changes (**integrity**), and service disruption via brute force or DoS (**availability**).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-postgresql-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 5432 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Postgres (5432) from the Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"<example_resource_name>\"\n VpcId: \"<example_resource_id>\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 5432\n ToPort: 5432\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0 or ::/0; limits access so 5432 is not open to the Internet\n```",
|
||||
"Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Locate any rule for PostgreSQL (port 5432) with Source 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific CIDR or security group\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Security group with Postgres (5432) not exposed to the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 5432\n to_port = 5432\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: avoid 0.0.0.0/0 or ::/0 to prevent Internet exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** on security groups: remove `0.0.0.0/0` and `::/0` for `5432`, allow only trusted CIDRs or private peers. Prefer **private access** (VPC-only) via VPN, bastion, or proxy. Add **defense in depth** with SG references and network ACLs, and enforce TLS and strong authentication.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis port 6379.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Redis TCP port 6379",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis port 6379.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** permitting Internet sources (`0.0.0.0/0` or `::/0`) to `TCP 6379` are identified, indicating Redis is reachable from public networks",
|
||||
"Risk": "Public Redis access undermines **confidentiality, integrity, and availability**:\n- Read keys and secrets\n- Modify or flush data and configs\n- Exhaust memory for DoS\nAttackers can brute-force `AUTH`, exploit replication or modules for code execution, and pivot within the VPC.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233806-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-6379-redis-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 6379 --cidr 0.0.0.0/0",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Redis (6379) from Internet\nResources:\n SecureSecurityGroup:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Redis access\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 6379\n ToPort: 6379\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR\n```",
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule allowing TCP port 6379 with Source 0.0.0.0/0 or ::/0\n5. Delete that rule (or change Source to a trusted CIDR or security group)\n6. Click Save rules",
|
||||
"Terraform": "```hcl\n# Security group with Redis limited to trusted sources\nresource \"aws_security_group\" \"secure\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 6379\n to_port = 6379\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Restrict Redis to **private connectivity** and apply **least privilege**:\n- Allow `6379` only from required app hosts, security groups, or CIDRs\n- Prefer VPC/private networks or VPN over public IPs\n- Enforce Redis `AUTH` and TLS, bind to private interfaces\n- Use segmentation and monitoring for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-13
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Windows SQL Server ports 1433 or 1434.",
|
||||
"CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Microsoft SQL Server ports 1433 and 1434",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Windows SQL Server ports 1433 or 1434.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** with inbound rules that allow Internet sources (`0.0.0.0/0`, `::/0`) to reach **Microsoft SQL Server** on `TCP 1433` or `TCP 1434`",
|
||||
"Risk": "**Internet-exposed SQL ports** enable credential brute force, service enumeration, and remote exploitation. Compromise can lead to unauthorized queries, data exfiltration or tampering, and outages via destructive commands, degrading **confidentiality**, **integrity**, and **availability**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000223371-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-windows-sql-server-ports-1433-or-14"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":1433,\"ToPort\":1433,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":1434,\"ToPort\":1434,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict SQL Server ports from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SQL ports\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1433\n ToPort: 1433\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; limits exposure to internal range\n - IpProtocol: tcp\n FromPort: 1434\n ToPort: 1434\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; blocks Internet access\n```",
|
||||
"Other": "1. Open the AWS Console > EC2 > Security Groups\n2. Select the target security group and open Inbound rules\n3. Find rules allowing TCP 1433 or 1434 from 0.0.0.0/0 or ::/0\n4. Delete those rules (or change Source to a specific CIDR or security group)\n5. Click Save rules",
|
||||
"Terraform": "```hcl\n# Restrict SQL Server ports from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 1433\n to_port = 1433\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restricts Internet access\n }\n\n ingress {\n from_port = 1434\n to_port = 1434\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; blocks Internet exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** on network access:\n- Restrict SQL ingress to trusted IPs or via VPN/bastion\n- Place databases in private subnets; allow only app-tier sources\n- Avoid `0.0.0.0/0` and `::/0`\n- Use **defense in depth** with network ACLs/firewalls\n- Monitor auth failures and rate-limit repeated attempts",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,29 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23",
|
||||
"CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.",
|
||||
"CheckTitle": "Security group does not allow ingress from the Internet to TCP port 23 (Telnet)",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are evaluated for rules that allow **inbound Telnet** on `TCP 23` from the Internet (`0.0.0.0/0` or `::/0`).",
|
||||
"Risk": "Public **Telnet** exposes cleartext credentials and remote shell access.\n- Brute-force and credential interception enable account takeover\n- Command execution enables data theft and lateral movement\n\nThis threatens confidentiality and integrity and can degrade availability through misuse.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233790-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-23-telnet-",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-telnet-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":23,\"ToPort\":23,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: restrict Telnet (port 23) from Internet\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Telnet\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 23\n ToPort: 23\n CidrIp: 10.0.0.0/8 # CRITICAL: Restricts Telnet (23) to internal range; removes Internet-wide (0.0.0.0/0) access\n```",
|
||||
"Other": "1. In the AWS console, go to VPC > Security Groups\n2. Select the affected security group and open Inbound rules\n3. Click Edit inbound rules\n4. Find any rule allowing TCP port 23 (Telnet) from 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific trusted CIDR\n6. Save rules",
|
||||
"Terraform": "```hcl\nresource \"aws_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 23\n to_port = 23\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: Restricts Telnet (23); do not use 0.0.0.0/0 or ::/0\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Remove rules permitting Internet access to `TCP 23` from `0.0.0.0/0` or `::/0`. Disable **Telnet** on hosts. Prefer **SSH** or **SSM** and apply **least privilege** network rules. Restrict admin access to trusted IPs, VPN, or private endpoints, and use **defense in depth** with NACLs and logging.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+18
-11
@@ -1,29 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_allow_wide_open_public_ipv4",
|
||||
"CheckTitle": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.",
|
||||
"CheckTitle": "Security group has no ingress or egress rules with public IPv4 CIDR ranges from /1 to /23",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"TTPs/Initial Access/Unauthorized Access"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** with rules that permit non-RFC1918 IPv4 ranges wider than `/24` are identified across both **ingress** and **egress**.\n\nThe focus is on public CIDRs (`/1`-`/23`) that broadly expose sources or destinations, not on private networks.",
|
||||
"Risk": "Over-broad public CIDRs expand exposure and enable:\n- **Confidentiality** loss via unauthorized access and exfiltration\n- **Integrity** compromise by exploiting exposed services\n- **Availability** impact from scanning and abuse\n\nOpen egress further allows **C2** beacons and bulk data exfiltration to untrusted IPs.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://support.icompaas.com/support/solutions/articles/62000229600-ensure-vpc-security-groups-not-wide-open-public-ipv4-cidr-ranges-non-rfc1918-",
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: ensure no public IPv4 CIDR wider than /24\nResources:\n \"<example_resource_name>\":\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"sg\"\n VpcId: \"<example_resource_id>\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 443\n ToPort: 443\n CidrIp: 203.0.113.0/24 # Critical: /24 (or private RFC1918) avoids wide-open public /1-/23\n```",
|
||||
"Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the security group with the finding\n3. Click Edit inbound rules (and Edit outbound rules if needed)\n4. For any rule with a public IPv4 CIDR mask /1-/23, delete it or change the CIDR to a private RFC1918 range or to /24 or more specific (e.g., 203.0.113.0/24)\n5. Save rules",
|
||||
"Terraform": "```hcl\n# Terraform: ensure no public IPv4 CIDR wider than /24\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress {\n from_port = 443\n to_port = 443\n protocol = \"tcp\"\n cidr_blocks = [\"203.0.113.0/24\"] # Critical: /24 (or private RFC1918) avoids wide-open public /1-/23\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** on security groups:\n- Allow only known IPs (prefer `/32` or tight CIDRs)\n- Use **private connectivity** (VPN, Direct Connect, private endpoints)\n- Restrict and log **egress**; deny by default\n- Segment with security group references and **network ACLs** for **defense-in-depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_wide_open_public_ipv4"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-11
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_default_restrict_traffic",
|
||||
"CheckTitle": "Ensure the default security group of every VPC restricts all traffic.",
|
||||
"CheckTitle": "VPC default security group has no inbound or outbound rules",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure the default security group of every VPC restricts all traffic.",
|
||||
"Risk": "Even having a perimeter firewall, having security groups open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
|
||||
"Description": "**Default VPC security group** should have **no inbound or outbound rules**. This evaluates whether the group allows any traffic-ingress, egress, or self-referencing-instead of remaining empty.",
|
||||
"Risk": "Permissive rules in the **default security group** mean instances that inherit it can communicate widely. This enables **lateral movement**, **port scanning**, and **data exfiltration**; unrestricted egress aids **C2**. Confidentiality and integrity are reduced, and the blast radius of a compromise grows.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_4#aws-console",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_4#terraform"
|
||||
"Other": "1. Open the AWS Console and go to VPC > Security > Security groups\n2. Select the security group named \"default\" for the affected VPC\n3. In Inbound rules, click Edit inbound rules, delete all rules, and Save\n4. In Outbound rules, click Edit outbound rules, delete all rules, and Save\n5. Repeat for each VPC that has this finding",
|
||||
"Terraform": "```hcl\nresource \"aws_default_security_group\" \"<example_resource_name>\" {\n vpc_id = \"<example_vpc_id>\"\n\n ingress = [] # Critical: removes all inbound rules from the default SG\n egress = [] # Critical: removes all outbound rules from the default SG\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive security groups. Recommended best practices is to narrow the definition for the minimum ports required.",
|
||||
"Url": "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html"
|
||||
"Text": "Enforce **least privilege**: keep the default group empty by removing all ingress and egress rules. Use dedicated security groups per workload with explicit sources, destinations, and ports. Regularly review for broad CIDRs like `0.0.0.0/0` and apply **defense in depth** via automation and policy guardrails.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_default_restrict_traffic"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+16
-12
@@ -1,29 +1,33 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_from_launch_wizard",
|
||||
"CheckTitle": "Security Groups created by EC2 Launch Wizard.",
|
||||
"CheckTitle": "Security group not created using the EC2 Launch Wizard",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Security Groups created by EC2 Launch Wizard.",
|
||||
"Risk": "Security Groups Created on the AWS Console using the EC2 wizard may allow port 22 from 0.0.0.0/0.",
|
||||
"Description": "**EC2 security groups** whose names include `launch-wizard` are identified as created by the **EC2 Launch Wizard**, distinguishing auto-generated groups from curated, baseline-controlled groups.",
|
||||
"Risk": "Wizard-generated groups often include **overly permissive rules** (e.g., `0.0.0.0/0` to admin ports), expanding exposure. Attackers can run **port scans** and **brute-force** to gain entry, then **lateral movement** and **data exfiltration**, impacting **confidentiality** and **integrity**; broad egress aids command-and-control.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-prefixed-with-launch-wizard.html",
|
||||
"https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-prefixed-with-launch-wizard.html",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 delete-security-group --group-id <SECURITY_GROUP_ID>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: create a security group not named by Launch Wizard\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: SG not created by Launch Wizard\n VpcId: <example_resource_id>\n GroupName: <example_resource_name> # Critical: name does NOT contain \"launch-wizard\" to avoid FAIL\n```",
|
||||
"Other": "1. In the AWS console, go to EC2 > Network & Security > Security Groups\n2. In the search box, filter by Name contains \"launch-wizard\"\n3. For each matching group, open the References tab and remove it from any ENIs/instances by replacing it with a different security group\n4. Select the launch-wizard security group and choose Actions > Delete security group > Delete\n5. Verify no security groups remain with names containing \"launch-wizard\"",
|
||||
"Terraform": "```hcl\n# Create a security group not named by Launch Wizard\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\" # Critical: name does NOT contain \"launch-wizard\" to avoid FAIL\n vpc_id = \"<example_resource_id>\"\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Apply Zero Trust approach. Implement a process to scan and remediate security groups created by the EC2 Wizard. Recommended best practices is to use an authorized security group.",
|
||||
"Url": "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html"
|
||||
"Text": "Replace or harden these groups. Apply **least privilege**: restrict inbound to required sources, avoid public admin ports, and minimize egress. Use approved baseline security groups, enforce change control with IaC and guardrails, prefer private administration (bastion or Session Manager), and remove unused rules.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_from_launch_wizard"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+18
-12
@@ -1,32 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_not_used",
|
||||
"CheckTitle": "Ensure there are no Security Groups not being used.",
|
||||
"CheckTitle": "Non-default EC2 security group is in use",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure there are no Security Groups not being used.",
|
||||
"Risk": "Having clear definition and scope for Security Groups creates a better administration environment.",
|
||||
"Description": "EC2 security groups, except `default`, are assessed for **unused** status: zero attached network interfaces, no AWS Lambda associations, and no references from other security groups.",
|
||||
"Risk": "Orphaned security groups may later be attached with **overly permissive rules** without review, enabling unintended inbound or lateral access that compromises **confidentiality** and **integrity**. They also create **configuration drift**, increasing the chance of misapplied access controls.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/default-security-group-unrestricted.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"CLI": "aws ec2 delete-security-group --group-id <SECURITY_GROUP_ID>",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the non-default security group that shows Used by = 0 (no network interfaces or resources)\n3. Click Actions > Delete security group > Delete",
|
||||
"Terraform": "```hcl\n# Destroy the unused non-default security group\nresource \"aws_security_group\" \"<example_resource_name>\" {\n count = 0 # Critical: setting count=0 removes/destroys this unused SG\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "List all the security groups and then use the cli to check if they are attached to an instance.",
|
||||
"Url": "https://aws.amazon.com/premiumsupport/knowledge-center/ec2-find-security-group-resources/"
|
||||
"Text": "Apply **least privilege** and strong lifecycle management: delete or quarantine **unused security groups**, enforce ownership tags and retention policies, review regularly, and manage changes via IaC with approvals. Restrict who can attach groups and use guardrails to prevent reuse of stale or permissive groups.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_not_used"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+21
-13
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_securitygroup_with_many_ingress_egress_rules",
|
||||
"CheckTitle": "Find security groups with more than 50 ingress or egress rules.",
|
||||
"CheckTitle": "Security group has 50 or fewer inbound rules and 50 or fewer outbound rules",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "securitygroup",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"Severity": "high",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsEc2SecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Find security groups with more than 50 ingress or egress rules.",
|
||||
"Risk": "If Security groups are not properly configured the attack surface is increased.",
|
||||
"Description": "**EC2 security groups** are evaluated for excessive rule counts, flagging groups where `ingress` or `egress` entries exceed the configured threshold (default `50`). This targets groups with unusually large rule sets that complicate access control.",
|
||||
"Risk": "**Rule sprawl** weakens **least privilege**: large rule sets can hide overly permissive entries, exposing services to the Internet or unintended peers. This enables unauthorized access, data exfiltration, and lateral movement, impacting **confidentiality** and **integrity**, and can threaten **availability** via abuse of exposed services.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-rules-counts.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Security group with limited number of rules\nResources:\n <example_resource_name>:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"<example_resource_name>\"\n VpcId: <example_resource_id>\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 443\n ToPort: 443\n CidrIp: 10.0.0.0/8 # Critical: keep total inbound rules 50; this example defines only 1 rule to ensure compliance\n```",
|
||||
"Other": "1. In the AWS console, go to EC2 > Security Groups\n2. Select the security group that FAILED\n3. In Inbound rules, click Edit inbound rules\n4. Delete rules until the inbound rule count is 50 or fewer, then Save\n5. In Outbound rules, click Edit outbound rules\n6. Delete rules until the outbound rule count is 50 or fewer, then Save",
|
||||
"Terraform": "```hcl\n# Terraform: Security group with limited number of rules\nresource \"aws_security_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n vpc_id = \"<example_resource_id>\"\n\n ingress { # Critical: keep total ingress/egress rules 50; single rule ensures PASS\n from_port = 443\n to_port = 443\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
|
||||
"Text": "Apply **least privilege** and **segmentation**:\n- Limit rules to required ports, protocols, and sources\n- Split workloads into dedicated security groups per role\n- Prefer SG-to-SG references over broad CIDRs\n- Regularly review, deduplicate, and remove stale rules\n- Layer controls (NACLs, private endpoints) for **defense in depth**",
|
||||
"Url": "https://hub.prowler.com/check/ec2_securitygroup_with_many_ingress_egress_rules"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+22
-14
@@ -1,32 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "ec2_transitgateway_auto_accept_vpc_attachments",
|
||||
"CheckTitle": "Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests",
|
||||
"CheckTitle": "Amazon EC2 Transit Gateway does not automatically accept shared VPC attachments",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"TTPs/Lateral Movement"
|
||||
],
|
||||
"ServiceName": "ec2",
|
||||
"SubServiceName": "transit-gateway",
|
||||
"ResourceIdTemplate": "arn:aws:ec2:region:account-id:transit-gateway/tgw-id",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsEc2TransitGateway",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure EC2 transit gateways are not automatically accepting shared VPC attachments. We get a fail if a transit gateway is configured to automatically accept shared VPC attachment requests.",
|
||||
"Risk": "Turning on AutoAcceptSharedAttachments allows a transit gateway to automatically accept any cross-account VPC attachment requests without verification. This increases the risk of unauthorized VPC attachments, compromising network security.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-transit-gateway-auto-vpc-attach-disabled.html",
|
||||
"Description": "**EC2 Transit Gateways** with `AutoAcceptSharedAttachments=enable` automatically approve cross-account **VPC attachments**.\n\nThe evaluation identifies transit gateways configured to auto-accept shared attachments.",
|
||||
"Risk": "Auto-accepting cross-account attachments can link untrusted VPCs to your routing domain, impacting:\n- **Confidentiality**: unintended visibility and data exfiltration\n- **Integrity**: route injection or traffic tampering\n- **Availability**: misrouting/blackholing and lateral movement",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/ec2-transit-gateway-auto-vpc-attach-disabled.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-23",
|
||||
"https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html#tgw-modifying"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-23",
|
||||
"Terraform": ""
|
||||
"CLI": "aws ec2 modify-transit-gateway --transit-gateway-id <example_resource_id> --options AutoAcceptSharedAttachments=disable",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Disable auto-accept for shared attachments on a Transit Gateway\nResources:\n <example_resource_name>:\n Type: AWS::EC2::TransitGateway\n Properties:\n Options:\n AutoAcceptSharedAttachments: disable # Critical: turns off automatic acceptance of shared VPC attachments\n```",
|
||||
"Other": "1. In the AWS Console, go to VPC > Transit Gateways\n2. Select the transit gateway and click Actions > Modify transit gateway\n3. Under Cross-account sharing options, uncheck Auto-accept shared attachments\n4. Click Save changes",
|
||||
"Terraform": "```hcl\n# Terraform: Disable auto-accept for shared attachments on a Transit Gateway\nresource \"aws_ec2_transit_gateway\" \"<example_resource_name>\" {\n auto_accept_shared_attachments = \"disable\" # Critical: prevents automatic acceptance of cross-account VPC attachments\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Turn off AutoAcceptSharedAttachments to ensure that only authorized VPC attachment requests are accepted",
|
||||
"Url": "https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html#tgw-modifying"
|
||||
"Text": "Disable `AutoAcceptSharedAttachments` and require **explicit approval** for every attachment.\n\nApply **least privilege** and **separation of duties** for approvers, limit shares to trusted accounts, and use **defense in depth** with segmentation and logging to audit the attachment lifecycle.",
|
||||
"Url": "https://hub.prowler.com/check/ec2_transitgateway_auto_accept_vpc_attachments"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
Reference in New Issue
Block a user