Project: KICS (Provisioning / Security & Compliance)
File: 381c3f2a-ef6f-4eff-99f7-b169cda3422c.md

title: Sensitive Port Is Exposed To Entire Network hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 381c3f2a-ef6f-4eff-99f7-b169cda3422c Query name: Sensitive Port Is Exposed To Entire Network Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol<br> ```json title="Positive test num. 1 - json file" hl_lines="33" { "format_version": "0.2", "terraform_version": "1.0.5", "planned_values": { "root_module": { "resources": [ { "address": "awssecuritygroup.invalid", "mode": "managed", "type": "awssecuritygroup", "name": "invalid", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "description": "invalid", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6cidrblocks": [ "::/0" ], "prefixlistids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "invalid", "from_port": 443, "ipv6cidrblocks": [], "prefixlistids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 443 } ], "name": "invalid", "revokeruleson_delete": false, "tags": { "Name": "invalid" }, "tags_all": { "Name": "invalid" }, "timeouts": null }, "sensitive_values": { "egress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [ false ], "prefixlistids": [], "security_groups": [] } ], "ingress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [], "prefixlistids": [], "security_groups": [] } ], "tags": {}, "tags_all": {} } } ] } }, "resource_changes": [ { "address": "awssecuritygroup.invalid", "mode": "managed", "type": "awssecuritygroup", "name": "invalid", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "invalid", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6cidrblocks": [ "::/0" ], "prefixlistids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "invalid", "from_port": 443, "ipv6cidrblocks": [], "prefixlistids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 443 } ], "name": "invalid", "revokeruleson_delete": false, "tags": { "Name": "invalid" }, "tags_all": { "Name": "invalid" }, "timeouts": null }, "after_unknown": { "arn": true, "egress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [ false ], "prefixlistids": [], "security_groups": [] } ], "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [], "prefixlistids": [], "security_groups": [] } ], "name_prefix": true, "owner_id": true, "tags": {}, "tags_all": {}, "vpc_id": true }, "before_sensitive": false, "after_sensitive": { "egress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [ false ], "prefixlistids": [], "security_groups": [] } ], "ingress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [], "prefixlistids": [], "security_groups": [] } ], "tags": {}, "tags_all": {} } } } ], "configuration": { "root_module": { "resources": [ { "address": "awssecuritygroup.invalid", "mode": "managed", "type": "awssecuritygroup", "name": "invalid", "providerconfigkey": "aws", "expressions": { "description": { "constant_value": "invalid" }, "egress": { "constant_value": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6cidrblocks": [ "::/0" ], "prefixlistids": null, "protocol": "-1", "security_groups": null, "self": null, "to_port": 0 } ] }, "ingress": { "constant_value": [ { "cidr_blocks": [

], "description": "invalid", "from_port": 443, "ipv6cidrblocks": null, "prefixlistids": null, "protocol": "tcp", "security_groups": null, "self": null, "to_port": 443 } ] }, "name": { "constant_value": "invalid" }, "tags": { "constant_value": { "Name": "invalid" } }, "vpc_id": { "references": [ "aws_vpc.vpc-a.id", "aws_vpc.vpc-a" ] } }, "schema_version": 1 } ] } } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="96 66 36 6 111 81 51 21" resource "awssecuritygroup" "positive1" { name = "allow_tls1" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2200 to_port = 2500 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } resource "awssecuritygroup" "positive2" { name = "allow_tls2" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 20 to_port = 60 protocol = "tcp" cidr_blocks = ["/0"] } } resource "awssecuritygroup" "positive3" { name = "allow_tls3" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 5000 to_port = 6000 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } resource "awssecuritygroup" "positive4" { name = "allow_tls4" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 20 to_port = 22 protocol = "tcp" cidr_blocks = ["/0"] } } resource "awssecuritygroup" "positive5" { name = "allow_tls5" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 445 to_port = 500 protocol = "udp" cidr_blocks = ["1.1.1.1/1","0.0.0.0/0", "2.2.3.4/12"] } } resource "awssecuritygroup" "positive6" { name = "allow_tls6" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 135 to_port = 170 protocol = "udp" cidr_blocks = ["10.68.0.0", "0.0.0.0/0"] } } resource "awssecuritygroup" "positive7" { name = "allow_tls7" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2383 to_port = 2383 protocol = "udp" cidr_blocks = ["/0", "1.2.3.4/12"] } } resource "awssecuritygroup" "positive8" { name = "allow_tls8" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["/0"] } } ``` ```json title="Negative test num. 1 - json file" { "format_version": "0.2", "terraform_version": "1.0.5", "planned_values": { "root_module": { "resources": [ { "address": "awssecuritygroup.invalid", "mode": "managed", "type": "awssecuritygroup", "name": "invalid", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "description": "invalid", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6cidrblocks": [ "::/0" ], "prefixlistids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "192.168.0.0/24" ], "description": "invalid", "from_port": 443, "ipv6cidrblocks": [], "prefixlistids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 443 } ], "name": "invalid", "revokeruleson_delete": false, "tags": { "Name": "invalid" }, "tags_all": { "Name": "invalid" }, "timeouts": null }, "sensitive_values": { "egress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [ false ], "prefixlistids": [], "security_groups": [] } ], "ingress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [], "prefixlistids": [], "security_groups": [] } ], "tags": {}, "tags_all": {} } } ] } }, "resource_changes": [ { "address": "awssecuritygroup.invalid", "mode": "managed", "type": "awssecuritygroup", "name": "invalid", "provider_name":

"change": { "actions": [ "create" ], "before": null, "after": { "description": "invalid", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6cidrblocks": [ "::/0" ], "prefixlistids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "192.168.0.0/24" ], "description": "invalid", "from_port": 443, "ipv6cidrblocks": [], "prefixlistids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 443 } ], "name": "invalid", "revokeruleson_delete": false, "tags": { "Name": "invalid" }, "tags_all": { "Name": "invalid" }, "timeouts": null }, "after_unknown": { "arn": true, "egress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [ false ], "prefixlistids": [], "security_groups": [] } ], "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [], "prefixlistids": [], "security_groups": [] } ], "name_prefix": true, "owner_id": true, "tags": {}, "tags_all": {}, "vpc_id": true }, "before_sensitive": false, "after_sensitive": { "egress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [ false ], "prefixlistids": [], "security_groups": [] } ], "ingress": [ { "cidr_blocks": [ false ], "ipv6cidrblocks": [], "prefixlistids": [], "security_groups": [] } ], "tags": {}, "tags_all": {} } } } ], "configuration": { "root_module": { "resources": [ { "address": "awssecuritygroup.invalid", "mode": "managed", "type": "awssecuritygroup", "name": "invalid", "providerconfigkey": "aws", "expressions": { "description": { "constant_value": "invalid" }, "egress": { "constant_value": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6cidrblocks": [ "::/0" ], "prefixlistids": null, "protocol": "-1", "security_groups": null, "self": null, "to_port": 0 } ] }, "ingress": { "constant_value": [ { "cidr_blocks": [ "192.168.0.0/24" ], "description": "invalid", "from_port": 443, "ipv6cidrblocks": null, "prefixlistids": null, "protocol": "tcp", "security_groups": null, "self": null, "to_port": 443 } ] }, "name": { "constant_value": "invalid" }, "tags": { "constant_value": { "Name": "invalid" } }, "vpc_id": { "references": [ "aws_vpc.vpc-a.id", "aws_vpc.vpc-a" ] } }, "schema_version": 1 } ] } } } ``` ```tf title="Negative test num. 2 - tf file" resource "awssecuritygroup" "negative1" { name = "allow_tls1" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2383 to_port = 2383 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] } } resource "awssecuritygroup" "negative2" { name = "allow_tls2" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2384 to_port = 2386 protocol = "tcp" cidr_blocks = ["/0"] } } resource "awssecuritygroup" "negative3" { name = "allow_tls3" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 25 to_port = 2500 protocol = "tcp" cidr_blocks = ["1.2.3.4/5"] } } resource "awssecuritygroup" "negative4" { name = "allow_tls4" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 25 to_port = 2500 protocol = "tcp" cidr_blocks = ["1.2.3.4/5"] } } resource "awssecuritygroup" "negative5" { name = "allow_tls5" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 25 to_port = 2500 protocol = "udp" cidr_blocks = ["1.2.3.4/5","0.0.0.0/12"] } } resource "awssecuritygroup" "negative6" { name = "allow_tls6" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["1.2.3.4/5","0.0.0.0/12"] } } ```