Project: KICS (Provisioning / Security & Compliance)
File: 65905cec-d691-4320-b320-2000436cb696.md

title: Security Group With Unrestricted Access To SSH hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 65905cec-d691-4320-b320-2000436cb696 Query name: Security Group With Unrestricted Access To SSH Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: 'SSH' (TCP:22) should not be public in AWS Security Group<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11" resource "awssecuritygroup" "positive1" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_tls" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="11" resource "awssecuritygroup" "positive2" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["192.120.0.0/16", "0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_tls" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="13" module "voteservicesg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "user-service" description = "Security group for user-service with custom ports open within VPC, and PostgreSQL publicly open" vpc_id = "vpc-12345678" ingress { description = "TLS from VPC" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_tls" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="13" module "voteservicesg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "user-service" description = "Security group for user-service with custom ports open within VPC, and PostgreSQL publicly open" vpc_id = "vpc-12345678" ingress { description = "TLS from VPC" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["192.120.0.0/16", "0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_tls" } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awssecuritygroup" "negative1" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["192.120.0.0/16", "75.132.0.0/16"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_tls" } } ``` ```tf title="Negative test num. 2 - tf file" module "voteservicesg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "user-service" description = "Security group for user-service with custom ports open within VPC, and PostgreSQL publicly open" vpc_id = "vpc-12345678" ingress { description = "TLS from VPC" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["192.120.0.0/16", "75.132.0.0/16"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_tls" } } ```