turbot/aws_compliance
Loading controls...

Control: 2 The VPC default security group should not allow inbound and outbound traffic

Description

This control checks that the default security group of a VPC does not allow inbound or outbound traffic.

It does not check for access restrictions for other security groups that are not default, and other VPC configurations.

Remediation

To remediate this issue, create new security groups and assign those security groups to your resources. To prevent the default security groups from being used, remove their inbound and outbound rules.

  1. Open the Amazon VPC console.
  2. In the navigation pane, choose Security groups. View the default security groups details to see the resources that are assigned to them.
  3. Select a default security group, and choose the Inbound rules tab. Choose Edit inbound rules. Then delete all of the inbound rules. Choose Save rules.
  4. Repeat the previous step for each default security group.
  5. Select a default security group and choose the Outbound rules tab. Choose Edit outbound rules. Then delete all of the outbound rules. Choose Save rules.
  6. Repeat the previous step for each default security group.

Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the Amazon VPC User Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_ec2_2

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_ec2_2 --share

SQL

This control uses a named query:

vpc_default_security_group_restricts_all_traffic

Tags