AWS Default Security Group does not restrict all traffic misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_12
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	8824de78-7e99-4ef2-9c3d-8110e12c7df7

Impact

A VPC comes with a default security group that has an initial setting denying all inbound traffic, allowing all outbound traffic, and allowing all traffic between instances assigned to the security group. If you do not specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that your default security group restricts all inbound and outbound traffic. The default VPC in every region should have its default security group updated to comply with this recommendation. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. Configuring all VPC default security groups to restrict all traffic will encourage least privilege security group development and mindful placement of AWS resources into security groups. This in-turn reduces the exposure of those resources.

NOTE: When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly. VPC flow logging can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering, discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation described is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.

How to Fix

Resource: aws_default_security_group + aws_vpc

• Arguments: vpc_id (of aws_default_security_group)

Ensure that no aws_vpc is connected to an aws_default_security_group where the ingress and/or egress had restrictions removed. + [source,go]

resource "aws_vpc" "issue_vpc" { cidr_block = "10.0.0.0/16" }

resource "aws_default_security_group" "default" { vpc_id = aws_vpc.issue_vpc.id

• ingress {
• protocol = "-1"
• self = true
• from_port = 0
• to_port = 0
• }
• egress {
• from_port = 0
• to_port = 0
• protocol = "-1"
• cidr_blocks = ["0.0.0.0/0"]
• } }

---