AWS Security Group allows all traffic on RDP port (3389) misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_25
Category - Subcategory	Public Exposure - Sensitive Ports
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	0351493c-9989-4b33-ad86-18dbe406e710

Impact

This policy identifies Security groups that allow all traffic on RDP port 3389. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network. Review your list of security group rules to ensure that your resources are not exposed. As a best practice, restrict RDP solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.

How to Fix

Resource: AWS::EC2::SecurityGroup

• Arguments: Properties.SecurityGroupIngress [source,go]

---

Type: AWS::EC2::SecurityGroup Properties: ... SecurityGroupIngress:

• Description: SSH Ingress IpProtocol: tcp FromPort: 3389 ToPort: 3389
• CidrIp: "0.0.0.0/0"
• CidrIp: "10.10.10.0/24"

---