Project: KICS (Provisioning / Security & Compliance)
File: 66f2d8f9-a911-4ced-ae27-34f09690bb2c.md

title: Security Groups Allows Unrestricted Outbound Traffic hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 66f2d8f9-a911-4ced-ae27-34f09690bb2c Query name: Security Groups Allows Unrestricted Outbound Traffic Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: No security group should allow unrestricted egress access<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="16" Parameters: KeyName: Description: The EC2 Key Pair to allow SSH access to the instance Type: 'AWS::EC2::KeyPair::KeyName' Resources: Ec2Instance: Type: 'AWS::EC2::Instance' Properties: SecurityGroups: !Ref InstanceSecurityGroup MyExistingSecurityGroup KeyName: !Ref KeyName ImageId: ami-7a11e213 InstanceSecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: IpProtocol: tcp FromPort: '22' ToPort: '22' CidrIp: 0.0.0.0/0 SecurityGroupEgress: IpProtocol: ALL FromPort: '22' ToPort: '22' CidrIp: 0.0.0.0/0 ``` ```json title="Positive test num. 2 - json file" hl_lines="21" { "Parameters": { "KeyName": { "Description": "The EC2 Key Pair to allow SSH access to the instance", "Type": "AWS::EC2::KeyPair::KeyName" } }, "Resources": { "Ec2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": "ami-7a11e213", "SecurityGroups": [ "InstanceSecurityGroup", "MyExistingSecurityGroup" ], "KeyName": "KeyName" } }, "InstanceSecurityGroup": { "Properties": { "SecurityGroupIngress": [ { "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp", "FromPort": "22", "ToPort": "22" } ], "SecurityGroupEgress": [ { "IpProtocol": "ALL", "FromPort": "22", "ToPort": "22", "CidrIp": "0.0.0.0/0" } ], "GroupDescription": "Enable SSH access via port 22" }, "Type": "AWS::EC2::SecurityGroup" } } } ``` ```yaml title="Negative test num. 1 - yaml file" Parameters: KeyName: Description: The EC2 Key Pair to allow SSH access to the instance Type: 'AWS::EC2::KeyPair::KeyName' Resources: Ec2Instance: Type: 'AWS::EC2::Instance' Properties: SecurityGroups: !Ref InstanceSecurityGroup MyExistingSecurityGroup KeyName: !Ref KeyName ImageId: ami-7a11e213 InstanceSecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: IpProtocol: tcp FromPort: '22' ToPort: '22' CidrIp: 0.0.0.0/0 SecurityGroupEgress: IpProtocol: tcp FromPort: '22' ToPort: '22' CidrIp: 0.0.0.0/0 ``` ```json title="Negative test num. 2 - json file" { "Parameters": { "KeyName": { "Description": "The EC2 Key Pair to allow SSH access to the instance", "Type": "AWS::EC2::KeyPair::KeyName" } }, "Resources": { "Ec2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "SecurityGroups": [ "InstanceSecurityGroup", "MyExistingSecurityGroup" ], "KeyName": "KeyName", "ImageId": "ami-7a11e213" } }, "InstanceSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Enable SSH access via port 22", "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": "22", "ToPort": "22", "CidrIp": "0.0.0.0/0" } ], "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp", "FromPort": "22", "ToPort": "22" } ] } } } } ```