Project: KICS (Provisioning / Security & Compliance)
File: 494b03d3-bf40-4464-8524-7c56ad0700ed.md

title: EC2 Sensitive Port Is Publicly Exposed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 494b03d3-bf40-4464-8524-7c56ad0700ed Query name: EC2 Sensitive Port Is Publicly Exposed Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: The EC2 instance has a sensitive port connection exposed to the entire network<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" AWSTemplateFormatVersion: 2010-09-09T00:00:00Z Resources: UnsafeSecGroup01: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow http and redis VpcId: my-vpc SecurityGroupIngress: FromPort: 8080 ToPort: 8080 CidrIp: 127.0.0.1/32 IpProtocol: tcp IpProtocol: tcp FromPort: 6379 ToPort: 6379 CidrIp: 10.0.0.1/0 SecurityGroupEgress: FromPort: 22 ToPort: 22 CidrIp: 0.0.0.0/0 IpProtocol: tcp EC2Instance01: Type: AWS::EC2::Instance Properties: ImageId: ami-79fd7eee InstanceType: t3.medium SecurityGroups: UnsafeSecGroup01 KeyName: my-new-rsa-key ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="8" AWSTemplateFormatVersion: 2010-09-09T00:00:00Z Resources: UnsafeSecGroup02: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow http and mysql VpcId: my-vpc SecurityGroupIngress: IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: 127.0.0.1/32 ToPort: 1434 CidrIp: 10.0.0.1/0 IpProtocol: tcp FromPort: 1433 IpProtocol: tcp FromPort: 150 ToPort: 180 CidrIp: 10.0.0.1/0 SecurityGroupEgress: IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 0.0.0.0/0 EC2Instance02: Type: AWS::EC2::Instance Properties: InstanceType: t3.medium SecurityGroups: UnsafeSecGroup02 KeyName: my-new-rsa-key ImageId: ami-79fd7eee ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="13" AWSTemplateFormatVersion: 2010-09-09T00:00:00Z Resources: UnsafeSecGroup03: Type: AWS::EC2::SecurityGroup Properties: SecurityGroupEgress: IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 0.0.0.0/0 GroupDescription: Allow http and hadoop VpcId: my-vpc SecurityGroupIngress: ToPort: 80 CidrIp: 0.0.0.0/0 IpProtocol: tcp FromPort: 80 ToPort: 9000 CidrIp: 10.0.0.1/0 IpProtocol: tcp FromPort: 9000 EC2Instance03: Type: AWS::EC2::Instance Properties: SecurityGroups: UnsafeSecGroup03 KeyName: my-new-rsa-key ImageId: ami-79fd7eee InstanceType: t3.medium ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="13" AWSTemplateFormatVersion: 2010-09-09T00:00:00Z Resources: UnsafeSecGroup04: Type: AWS::EC2::SecurityGroup Properties: SecurityGroupEgress: IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 0.0.0.0/0 GroupDescription: Allow LDAP and SNMP VpcId: my-vpc SecurityGroupIngress: ToPort: 389 FromPort: 389 IpProtocol: all CidrIp: 10.0.0.0/0 ToPort: 150 FromPort: 180 IpProtocol: udp CidrIp: 10.0.0.1/0 ToPort: 53 FromPort: 53 IpProtocol: "-1" CidrIp: 10.0.0.1/0 EC2Instance03: Type: AWS::EC2::Instance Properties: SecurityGroups: UnsafeSecGroup04 KeyName: my-new-rsa-key ImageId: ami-79fd7eee InstanceType: t3.medium ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="17" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "UnsafeSecGroup01": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "SecurityGroupEgress": [ { "FromPort": 22, "ToPort": 22, "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp" } ], "GroupDescription": "Allow http and redis", "VpcId": "my-vpc", "SecurityGroupIngress": [ { "FromPort": 8080, "ToPort": 8080, "CidrIp": "127.0.0.1/32", "IpProtocol": "tcp" }, { "IpProtocol": "tcp", "FromPort": 6379, "ToPort": 6379, "CidrIp": "10.0.0.1/0" } ] } }, "EC2Instance01": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": "ami-79fd7eee", "InstanceType": "t3.medium", "SecurityGroups": [ "UnsafeSecGroup01" ], "KeyName": "my-new-rsa-key" } } } } ``` </details> <details><summary>Positive test

6 - json file</summary> ```json hl_lines="9" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "UnsafeSecGroup02": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allow http and mysql", "VpcId": "my-vpc", "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "CidrIp": "127.0.0.1/32" }, { "CidrIp": "10.0.0.1/0", "IpProtocol": "tcp", "FromPort": 1433, "ToPort": 1434 }, { "IpProtocol": "tcp", "FromPort": 150, "ToPort": 180, "CidrIp": "10.0.0.1/0" } ], "SecurityGroupEgress": [ { "FromPort": 22, "ToPort": 22, "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp" } ] } }, "EC2Instance02": { "Type": "AWS::EC2::Instance", "Properties": { "SecurityGroups": [ "UnsafeSecGroup02" ], "KeyName": "my-new-rsa-key", "ImageId": "ami-79fd7eee", "InstanceType": "t3.medium" } } } } ``` </details> <details><summary>Positive test num. 7 - json file</summary> ```json hl_lines="16" { "Resources": { "UnsafeSecGroup03": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp", "FromPort": 22, "ToPort": 22 } ], "GroupDescription": "Allow http and hadoop", "VpcId": "my-vpc", "SecurityGroupIngress": [ { "FromPort": 80, "ToPort": 80, "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp" }, { "ToPort": 9000, "CidrIp": "10.0.0.1/0", "IpProtocol": "tcp", "FromPort": 9000 } ] } }, "EC2Instance03": { "Type": "AWS::EC2::Instance", "Properties": { "SecurityGroups": [ "UnsafeSecGroup03" ], "KeyName": "my-new-rsa-key", "ImageId": "ami-79fd7eee", "InstanceType": "t3.medium" } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` </details> <details><summary>Positive test num. 8 - json file</summary> ```json hl_lines="16" { "Resources": { "UnsafeSecGroup04": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp", "FromPort": 22, "ToPort": 22 } ], "GroupDescription": "Allow LDAP and SNMP", "VpcId": "my-vpc", "SecurityGroupIngress": [ { "CidrIp": "10.0.0.0/0", "ToPort": 389, "FromPort": 389, "IpProtocol": "all" }, { "FromPort": 180, "IpProtocol": "udp", "CidrIp": "10.0.0.1/0", "ToPort": 150 }, { "IpProtocol": "-1", "CidrIp": "10.0.0.1/0", "ToPort": 53, "FromPort": 53 } ] } }, "EC2Instance03": { "Type": "AWS::EC2::Instance", "Properties": { "SecurityGroups": [ "UnsafeSecGroup04" ], "KeyName": "my-new-rsa-key", "ImageId": "ami-79fd7eee", "InstanceType": "t3.medium" } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09T00:00:00Z Resources: SafeSecGroup: Type: AWS::EC2::SecurityGroup Properties: SecurityGroupEgress: IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 127.0.0.1/32 GroupDescription: Allow http and ssh VpcId: my-vpc SecurityGroupIngress: FromPort: 80 ToPort: 80 CidrIp: 127.0.0.1/32 IpProtocol: tcp ToPort: 77 CidrIp: 127.0.0.1/32 IpProtocol: all FromPort: 77 MyNegativeEC2Instance: Type: AWS::EC2::Instance Properties: SecurityGroups: SafeSecGroup KeyName: my-new-rsa-key ImageId: ami-79fd7eee InstanceType: t3.medium ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "SafeSecGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allow http and ssh", "VpcId": "my-vpc", "SecurityGroupIngress": [ { "FromPort": 80, "ToPort": 80, "CidrIp": "127.0.0.1/32", "IpProtocol": "tcp" }, { "ToPort": 77, "CidrIp": "127.0.0.1/32", "IpProtocol": "all", "FromPort": 77 } ], "SecurityGroupEgress": [ { "FromPort": 22, "ToPort": 22, "CidrIp": "127.0.0.1/32", "IpProtocol": "tcp" } ] } }, "MyNegativeEC2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "SecurityGroups": [ "SafeSecGroup" ], "KeyName": "my-new-rsa-key", "ImageId": "ami-79fd7eee", "InstanceType": "t3.medium" } } } } ```