Project: KICS (Provisioning / Security & Compliance)
File: a3e4e39a-e5fc-4ee9-8cf5-700febfa86dd.md

title: Security Group Ingress Has CIDR Not Recommended hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a3e4e39a-e5fc-4ee9-8cf5-700febfa86dd Query name: Security Group Ingress Has CIDR Not Recommended Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: AWS Security Group Ingress CIDR should not be /32 in case of IPV4 or /128 in case of IPV6<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="43 13" Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow http to client host VpcId: Ref: myVPC SecurityGroupIngress: IpProtocol: tcp Description: TCP FromPort: 80 ToPort: 80 CidrIp: 122.24.0.0/32 SecurityGroupEgress: IpProtocol: tcp Description: TCP FromPort: 80 ToPort: 80 CidrIp: 192.0.2.0/24 OutboundRule: Type: AWS::EC2::SecurityGroupEgress Properties: Description: TCP IpProtocol: tcp FromPort: 0 ToPort: 65535 CidrIp: 192.0.2.0/24 DestinationSecurityGroupId: Fn::GetAtt: TargetSG GroupId GroupId: Fn::GetAtt: SourceSG GroupId InboundRule: Type: AWS::EC2::SecurityGroupIngress Properties: Description: TCP IpProtocol: tcp FromPort: 0 ToPort: 65535 CidrIpv6: ::/128 SourceSecurityGroupId: Fn::GetAtt: SourceSG GroupId GroupId: Fn::GetAtt: TargetSG GroupId ``` ```json title="Positive test num. 2 - json file" hl_lines="44 69" { "Resources": { "OutboundRule": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "ToPort": 65535, "CidrIp": "192.0.2.0/24", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "TargetSG", "GroupId" ] }, "GroupId": { "Fn::GetAtt": [ "SourceSG", "GroupId" ] }, "Description": "TCP", "IpProtocol": "tcp", "FromPort": 0 } }, "InboundRule": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "SourceSecurityGroupId": { "Fn::GetAtt": [ "SourceSG", "GroupId" ] }, "GroupId": { "Fn::GetAtt": [ "TargetSG", "GroupId" ] }, "Description": "TCP", "IpProtocol": "tcp", "FromPort": 0, "ToPort": 65535, "CidrIpv6": "::/128" } }, "InstanceSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "SecurityGroupEgress": [ { "ToPort": 80, "CidrIp": "192.0.2.0/24", "IpProtocol": "tcp", "Description": "TCP", "FromPort": 80 } ], "GroupDescription": "Allow http to client host", "VpcId": { "Ref": "myVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "Description": "TCP", "FromPort": 80, "ToPort": 80, "CidrIp": "122.24.0.0/32" } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow http to client host VpcId: Ref: myVPC SecurityGroupIngress: IpProtocol: tcp Description: TCP FromPort: 80 ToPort: 80 CidrIp: 192.0.2.0/24 SecurityGroupEgress: IpProtocol: tcp Description: TCP FromPort: 80 ToPort: 80 CidrIp: 192.0.2.0/24 OutboundRule: Type: AWS::EC2::SecurityGroupEgress Properties: Description: TCP IpProtocol: tcp FromPort: 0 ToPort: 0 CidrIp: 192.0.2.0/24 DestinationSecurityGroupId: Fn::GetAtt: TargetSG GroupId GroupId: Fn::GetAtt: SourceSG GroupId InboundRule: Type: AWS::EC2::SecurityGroupIngress Properties: Description: TCP IpProtocol: tcp FromPort: 0 ToPort: 0 CidrIpv6: 2001:0DB8:1234::/48 SourceSecurityGroupId: Fn::GetAtt: SourceSG GroupId GroupId: Fn::GetAtt: TargetSG GroupId ``` ```json title="Negative test num. 2 - json file" { "Resources": { "InstanceSecurityGroup": { "Properties": { "VpcId": { "Ref": "myVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "Description": "TCP", "FromPort": 80, "ToPort": 80, "CidrIp": "192.0.2.0/24" } ], "SecurityGroupEgress": [ { "ToPort": 80, "CidrIp": "192.0.2.0/24", "IpProtocol": "tcp", "Description": "TCP", "FromPort": 80 } ], "GroupDescription": "Allow http to client host" }, "Type": "AWS::EC2::SecurityGroup" }, "OutboundRule": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "ToPort": 0, "CidrIp": "192.0.2.0/24", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "TargetSG", "GroupId" ] }, "GroupId": { "Fn::GetAtt": [ "SourceSG", "GroupId" ] }, "Description": "TCP", "IpProtocol": "tcp", "FromPort": 0 } }, "InboundRule": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "ToPort": 0, "CidrIpv6": "2001:0DB8:1234::/48", "SourceSecurityGroupId": { "Fn::GetAtt": [ "SourceSG", "GroupId" ] }, "GroupId": { "Fn::GetAtt": [ "TargetSG", "GroupId" ] }, "Description": "TCP", "IpProtocol": "tcp", "FromPort": 0 } } } } ```