Project: KICS (Provisioning / Security & Compliance)
File: 4728cd65-a20c-49da-8b31-9c08b423e4db.md

title: Unrestricted Security Group Ingress hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4728cd65-a20c-49da-8b31-9c08b423e4db Query name: Unrestricted Security Group Ingress Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: Security groups allow ingress from 0.0.0.0:0 and/or ::/0<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "awssecuritygroup_rule" "positive1" { type = "ingress" from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] securitygroupid = awssecuritygroup.default.id } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="9" module "webserversg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingressipv6cidr_blocks = ["fc00::/8", "::/0"] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="6" resource "awssecuritygroup" "positive2" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] securitygroupid = awssecuritygroup.default.id } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="13" resource "awssecuritygroup" "positive3" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["1.0.0.0/0"] } ingress { from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="9" module "webserversg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingresscidrblocks = ["0.0.0.0/0"] } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="9" module "webserversg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingresscidrblocks = ["10.10.0.0/16", "0.0.0.0/0"] } ``` </details> <details><summary>Positive test num. 7 - tf file</summary> ```tf hl_lines="6" resource "awssecuritygroup_rule" "positive6" { type = "ingress" from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["::/0"] securitygroupid = awssecuritygroup.default.id } ``` </details> <details><summary>Positive test num. 8 - tf file</summary> ```tf hl_lines="6" resource "awssecuritygroup" "positive7" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["::/0"] securitygroupid = awssecuritygroup.default.id } } ``` </details> <details><summary>Positive test

9 - tf file</summary> ```tf hl_lines="13" resource "awssecuritygroup" "positive8" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["fc00::/8"] } ingress { from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["::/0"] } } ``` </details> <details><summary>Positive test num. 10 - tf file</summary> ```tf hl_lines="9" module "webserversg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingressipv6cidr_blocks = ["::/0"] } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awssecuritygroup_rule" "negative1" { type = "ingress" from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["0.0.2.0/0"] securitygroupid = awssecuritygroup.default.id } ``` ```tf title="Negative test num. 2 - tf file" resource "awssecuritygroup" "negative2" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["0.0.2.0/0"] securitygroupid = awssecuritygroup.default.id } } ``` ```tf title="Negative test num. 3 - tf file" resource "awssecuritygroup" "negative3" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["1.0.0.0/0"] } ingress { from_port = 3306 to_port = 3306 protocol = "tcp" cidr_blocks = ["0.0.1.0/0"] } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "webserversg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingresscidrblocks = ["10.10.0.0/16"] } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf resource "awssecuritygroup_rule" "negative5" { type = "ingress" from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["fc00::/8"] securitygroupid = awssecuritygroup.default.id } ``` </details> <details><summary>Negative test num. 6 - tf file</summary> ```tf resource "awssecuritygroup" "negative6" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["fc00::/8"] securitygroupid = awssecuritygroup.default.id } } ``` </details> <details><summary>Negative test num. 7 - tf file</summary> ```tf resource "awssecuritygroup" "negative7" { ingress { from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["fc00::/9"] } ingress { from_port = 3306 to_port = 3306 protocol = "tcp" ipv6cidrblocks = ["fc00::/8"] } } ``` </details> <details><summary>Negative test num. 8 - tf file</summary> ```tf module "webserversg" { source = "terraform-aws-modules/security-group/aws" version = "4.3.0" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingressipv6cidr_blocks = ["fc00::/8"] } ``` </details>