cis-aws-compute-5-5

name	cis-aws-compute-5.5
description	Ensure RDP is restricted to only IP address that should have this access
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","lightsail","rdp","ip-restriction","access-control","windows","firewall"]
cis_id	5.5
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-5.3","cis-aws-compute-5.4","cis-aws-compute-5.6"]
prerequisites	[]
severity_boost	{}

5.5 Ensure RDP is restricted to only IP address that should have this access (Manual)

Description

Any ports enable within Lightsail by default are open and exposed to the world. For SSH and RDP access you should identify which IP address need access.

Rationale

Any ports enable within Lightsail by default are open and exposed to the world. This can result in outside traffic trying to access or even deny access to the Lightsail instances. Removing and adding approved IP address required for access.

Impact

N/A

Audit Procedure

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com
2. Click All services, click Lightsail under Compute.
3. This will open up the Lightsail console.
4. Select the Windows Instance you want to review.
5. Go to the Networking section.
6. Confirm that the RDP Port is restricted to an IP address

Application	Protocol	Port or range / Code	Restricted to
RDP	TCP	3389	101.221.11.11

7. If RDP is needed and it is open to Any IPv4 address refer to the remediation below.

Using AWS CLI

1. Run aws lightsail get-instances

aws lightsail get-instances --query "instances[*].name"

This command will provide a list of Instance names.

2. Run aws lightsail get-instance-port-states for any Windows instances listed

aws lightsail get-instance-port-states --instance-name <instance_name>

This command will provide a list of available Ports for the Instance name.

{
    "fromPort": 3389,
    "toPort": 3389,
    "protocol"