Project: KICS (Provisioning / Security & Compliance)
File: 4849211b-ac39-479e-ae78-5694d506cb24.md

title: Security Group Not Used hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4849211b-ac39-479e-ae78-5694d506cb24 Query name: Security Group Not Used Platform: Terraform Severity: <span style="color:#5bc0de">Info</span> Category: Access Control URL: Security group must be used or not declared<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8" resource "aws_lb" "test" { name = "test" loadbalancertype = "application" subnets = [awssubnet.subnet1.id, awssubnet.subnet2.id] internal = true } resource "awssecuritygroup" "allow_tls" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } tags = { Name = "allow_tls" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="15" resource "aws_instance" "positive1" { ami = "ami-003634241a8fcdec0" instance_type = "t2.micro" } resource "awssecuritygroup" "unused-sg" { name = "unused-sg" description = "Unused security group" vpcid = awsvpc.main.id ingress { description = "Some port" from_port = 42 to_port = 42 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="19" resource "aws_instance" "positive1" { ami = "ami-003634241a8fcdec0" instance_type = "t2.micro" vpcsecuritygroupids = [ awssecuritygroup.usedsg.id ] } resource "awssecuritygroup" "unused_sg" { name = "unused-sg" description = "Unused security group" vpcid = awsvpc.main.id ingress { description = "Some port" from_port = 42 to_port = 42 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } } resource "awssecuritygroup" "used_sg" { name = "used-sg" description = "Used security group" vpcid = awsvpc.main.id ingress { description = "Some port" from_port = 43 to_port = 43 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="21" resource "awsekscluster" "positive4" { name = "beautiful-eks" rolearn = awsiam_role.example.arn vpc_config { securitygroupids = [ awssecuritygroup.used_sg.id ] } } resource "awssecuritygroup" "unused_sg" { name = "unused-sg" description = "Unused security group" vpcid = awsvpc.main.id ingress { description = "Some port" from_port = 42 to_port = 42 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } } resource "awssecuritygroup" "used_sg" { name = "used-sg" description = "Used security group" vpcid = awsvpc.main.id ingress { description = "Some port" from_port = 43 to_port = 43 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awssecuritygroup" "allow_tls" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks =

} egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } tags = { Name = "allow_tls" } } resource "aws_lb" "test" { name = "test" loadbalancertype = "application" subnets = [awssubnet.subnet1.id, awssubnet.subnet2.id] internal = true securitygroups = [awssecuritygroup.allowtls.id] } ``` ```tf title="Negative test num. 2 - tf file" resource "awssecuritygroup" "allow_tls" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } tags = { Name = "allow_tls" } } module "securitygroupstest" { source = "terraform-aws-modules/security-group/aws//modules/http-80" version = "4.3.0" name = "web-server" securitygroupid = awssecuritygroup.allow_tls.id } ``` ```tf title="Negative test num. 3 - tf file" resource "awssecuritygroup" "used_sg" { name = "used-sg" description = "Used security group" vpcid = awsvpc.main.id ingress { description = "Some port" from_port = 43 to_port = 43 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } } resource "aws_instance" "negative3" { ami = "ami-003634241a8fcdec0" instance_type = "t2.micro" vpcsecuritygroupids = [ "awssecuritygroup.usedsg.id" ] } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 4.0" } } required_version = ">= 1.1.0" } variable "iam_role" { type = string default = "AmazonSSMRoleForInstancesQuickSetup" description = "Set AWS IAM role." } variable "ami_owner" { type = string default = "self" description = "Set AWS image owner." } variable "region" { type = string default = "eu-west-3" description = "Set AWS region." } variable "secgroups" { type = list(string) default = ["CowrieSSH"] description = "Set AWS security groups." } data "aws_ami" "cowrie" { most_recent = true owners = ["var.ami_owner"] filter { name = "name" values = ["cowrie-packer-*"] } filter { name = "virtualization-type" values = ["hvm"] } } provider "aws" { profile = "default" region = var.region } resource "awssecuritygroup" "cowrie" { name = "CowrieSSH" description = "CowrieSSH Terraform security group" ingress { description = "Allow anyone to connect to the honeypot." from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { description = "Allow all outgoing traffic." from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } tags = { Name = "cowriesshsg" purpose = "honeypot" } } resource "awsinstance" "cowrieserver" { ami = data.aws_ami.cowrie.id instance_type = "t3.nano" security_groups = var.secgroups iaminstanceprofile = var.iam_role metadata_options { http_endpoint = "enabled" http_tokens = "required" } tags = { Name = "cowrie", author = "foo" vcs-url = "https://github.com/foo/bar" purpose = "honeypot" } } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf resource "awssecuritygroup" "used_sg" { name = "used-sg" description = "Used security group" vpcid = awsvpc.main.id ingress { description = "Some port" from_port = 43 to_port = 43 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } } resource "awsekscluster" "negative3" { name = "beautiful-eks" rolearn = awsiam_role.example.arn vpc_config { securitygroupids = [ "awssecuritygroup.used_sg.id" ] } } ``` </details>