Alibaba Cloud Security group allow internet traffic to RDP port (3389) misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_3
Category - Subcategory	Public Exposure - Sensitive Ports
Provider	ALIBABA_CLOUD
Severity	LOW
Framework	Terraform

Impact

This rule identifies Security groups that allow inbound traffic on RDP port (3389) from the public internet. As a best practice, restrict security groups to only allow permitted traffic and limit brute force attacks on your network.

How to Fix

Resource: alicloud_security_group_rule

• Attribute: cidr_ip

To mitigate this issue, ensure that the cidr_ip attribute in the alicloud_security_group_rule resource does not include 0.0.0.0/0 for ingress on port 3389.

Example: [source,go]

resource "alicloud_security_group_rule" "example" { ... type = "ingress" ip_protocol = "tcp" port_range = "3389/3389"

• cidr_ip = "0.0.0.0/0"

• cidr_ip = "192.168.1.0/24" }

---