Project: KICS (Provisioning / Security & Compliance)
File: 0104165b-02d5-426f-abc9-91fb48189899.md

title: DB Security Group Open To Large Scope hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0104165b-02d5-426f-abc9-91fb48189899 Query name: DB Security Group Open To Large Scope Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: The IP address in a DB Security Group must not have more than 256 hosts.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="18" Resources: DBinstance1: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: "DbSecurity" AllocatedStorage: "5" DBInstanceClass: "db.t3.small" Engine: "MySQL" MasterUsername: "YourName" MasterUserPassword: "YourPassword" DeletionPolicy: "Snapshot" DbSecurity: Type: AWS::RDS::DBSecurityGroup Properties: GroupDescription: "Ingress for Amazon EC2 security group" DBSecurityGroupIngress: CIDRIP: 1.2.3.4/23 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="18" Resources: DBinstance2: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: "DbSecurityByEC2SecurityGroup1" AllocatedStorage: "5" DBInstanceClass: "db.t3.small" Engine: "MySQL" MasterUsername: "YourName" MasterUserPassword: "YourPassword" DeletionPolicy: "Snapshot" DbSecurityByEC2SecurityGroup1: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: "Ingress for Amazon EC2 security group" SecurityGroupIngress: CidrIp: 1.2.3.4/23 ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="18" Resources: DBinstance3: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: "DbSecurityByEC2SecurityGroup2" AllocatedStorage: "5" DBInstanceClass: "db.t3.small" Engine: "MySQL" MasterUsername: "YourName" MasterUserPassword: "YourPassword" DeletionPolicy: "Snapshot" DbSecurityByEC2SecurityGroup2: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: "Ingress for Amazon EC2 security group" SecurityGroupIngress: CidrIpv6: 2001:db8:a::123/64 ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="23" { "Resources": { "DBinstance1": { "DeletionPolicy": "Snapshot", "Type": "AWS::RDS::DBInstance", "Properties": { "DBInstanceClass": "db.t3.small", "Engine": "MySQL", "MasterUsername": "YourName", "MasterUserPassword": "YourPassword", "DBSecurityGroups": [ { "Ref": "DbSecurity" } ], "AllocatedStorage": "5" } }, "DbSecurity": { "Type": "AWS::RDS::DBSecurityGroup", "Properties": { "GroupDescription": "Ingress for Amazon EC2 security group", "DBSecurityGroupIngress": { "CIDRIP": "1.2.3.4/23" } } } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="23" { "Resources": { "DBinstance2": { "DeletionPolicy": "Snapshot", "Type": "AWS::RDS::DBInstance", "Properties": { "DBSecurityGroups": [ { "Ref": "DbSecurityByEC2SecurityGroup1" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t3.small", "Engine": "MySQL", "MasterUsername": "YourName", "MasterUserPassword": "YourPassword" } }, "DbSecurityByEC2SecurityGroup1": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Ingress for Amazon EC2 security group", "SecurityGroupIngress": { "CidrIp": "1.2.3.4/23" } } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="23" { "Resources": { "DBinstance3": { "Type": "AWS::RDS::DBInstance", "Properties": { "MasterUsername": "YourName", "MasterUserPassword": "YourPassword", "DBSecurityGroups": [ { "Ref": "DbSecurityByEC2SecurityGroup2" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t3.small", "Engine": "MySQL" }, "DeletionPolicy": "Snapshot" }, "DbSecurityByEC2SecurityGroup2": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Ingress for Amazon EC2 security group", "SecurityGroupIngress": { "CidrIpv6": "2001:db8:a::123/64" } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: DBinstance: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: "DbSecurityByEC2SecurityGroup" AllocatedStorage: "5" DBInstanceClass: "db.t3.small" Engine: "MySQL" MasterUsername: "YourName" MasterUserPassword: "YourPassword" DeletionPolicy: "Snapshot" DbSecurityByEC2SecurityGroup: Type: AWS::RDS::DBSecurityGroup Properties: GroupDescription: "Ingress for Amazon EC2 security group" DBSecurityGroupIngress: CIDRIP: 1.2.3.4/28 ``` ```json title="Negative test num. 2 - json file" { "Resources": { "DBinstance": { "Type": "AWS::RDS::DBInstance", "Properties": { "MasterUsername": "YourName", "MasterUserPassword": "YourPassword", "DBSecurityGroups": [ { "Ref": "DbSecurityByEC2SecurityGroup" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t3.small", "Engine": "MySQL" }, "DeletionPolicy": "Snapshot" }, "DbSecurityByEC2SecurityGroup": { "Type": "AWS::RDS::DBSecurityGroup", "Properties": { "GroupDescription": "Ingress for Amazon EC2 security group", "DBSecurityGroupIngress": { "CIDRIP": "1.2.3.4/28" } } } } } ```