Project: KICS (Provisioning / Security & Compliance)
File: 92fe237e-074c-4262-81a4-2077acb928c1.md

title: Sensitive Port Is Exposed To Wide Private Network hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 92fe237e-074c-4262-81a4-2077acb928c1 Query name: Sensitive Port Is Exposed To Wide Private Network Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: A sensitive port, such as port 23 or port 110, is open for a wide private network in either TCP or UDP protocol<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "awssecuritygroup" "positive1" { name = "allow_tls1" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2200 to_port = 2500 protocol = "-1" cidr_blocks = ["10.0.0.0/8"] } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="6" resource "awssecuritygroup" "positive2" { name = "allow_tls2" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 20 to_port = 60 protocol = "tcp" cidr_blocks = ["192.168.0.0/16"] } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="6" resource "awssecuritygroup" "positive3" { name = "allow_tls3" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 5000 to_port = 6000 protocol = "-1" cidr_blocks = ["172.16.0.0/12"] } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="6" resource "awssecuritygroup" "positive4" { name = "allow_tls4" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 20 to_port = 22 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="6" resource "awssecuritygroup" "positive5" { name = "allow_tls5" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 445 to_port = 500 protocol = "udp" cidr_blocks = ["192.168.0.0/16", "0.0.0.0/0", "2.2.3.4/12"] } } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="6" resource "awssecuritygroup" "positive6" { name = "allow_tls6" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 135 to_port = 170 protocol = "udp" cidr_blocks = ["10.68.0.0", "172.16.0.0/12"] } } ``` </details> <details><summary>Positive test num. 7 - tf file</summary> ```tf hl_lines="6" resource "awssecuritygroup" "positive7" { name = "allow_tls7" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2383 to_port = 2383 protocol = "udp" cidr_blocks = ["192.168.0.0/16", "10.0.0.0/8"] } } ``` </details> <details><summary>Positive test num. 8 - tf file</summary> ```tf hl_lines="6" resource "awssecuritygroup" "positive8" { name = "allow_tls8" description = "Allow TLS inbound traffic" vpcid =

ingress { description = "TLS from VPC" from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["172.16.0.0/12"] } } ``` </details> <details><summary>Positive test num. 9 - tf file</summary> ```tf hl_lines="9" module "voteservicesg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "user-service" description = "Security group for user-service with custom ports open within VPC, and PostgreSQL publicly open" vpc_id = "vpc-12345678" ingresswithcidr_blocks = [ { description = "TLS from VPC" from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["172.16.0.0/12"] } ] } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awssecuritygroup" "negative1" { name = "allow_tls1" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2383 to_port = 2383 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] } } ``` ```tf title="Negative test num. 2 - tf file" resource "awssecuritygroup" "negative2" { name = "allow_tls2" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 2384 to_port = 2386 protocol = "tcp" cidr_blocks = ["/0"] } } ``` ```tf title="Negative test num. 3 - tf file" resource "awssecuritygroup" "negative3" { name = "allow_tls3" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 25 to_port = 2500 protocol = "tcp" cidr_blocks = ["1.2.3.4/0"] } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf resource "awssecuritygroup" "negative4" { name = "allow_tls4" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 25 to_port = 2500 protocol = "tcp" cidr_blocks = ["1.2.3.4/5"] } } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf resource "awssecuritygroup" "negative5" { name = "allow_tls5" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 25 to_port = 2500 protocol = "udp" cidr_blocks = ["1.2.3.4/5", "0.0.0.0/12"] } } ``` </details> <details><summary>Negative test num. 6 - tf file</summary> ```tf resource "awssecuritygroup" "negative6" { name = "allow_tls6" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["1.2.3.4", "0.0.0.0/0"] } } ``` </details> <details><summary>Negative test num. 7 - tf file</summary> ```tf module "voteservicesg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "user-service" description = "Security group for user-service with custom ports open within VPC, and PostgreSQL publicly open" vpc_id = "vpc-12345678" ingresswithcidr_blocks = [ { description = "TLS from VPC" from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["1.2.3.4", "0.0.0.0/0"] } ] } ``` </details>