cis-aws-compute-5-3

name	cis-aws-compute-5.3
description	Disable SSH and RDP ports for Lightsail instances when not needed
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","lightsail","ssh","rdp","ports","firewall","networking"]
cis_id	5.3
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-5.4","cis-aws-compute-5.5","cis-aws-compute-5.6"]
prerequisites	[]
severity_boost	{}

5.3 Disable SSH and RDP ports for Lightsail instances when not needed (Manual)

Description

Any ports enable within Lightsail by default are open and exposed to the world. For SSH and RDP access you should remove and disable these ports when not is use.

Rationale

Any ports enable within Lightsail by default are open and exposed to the world. This can result in outside traffic trying to access or even deny access to the Lightsail instances. Removing and disabling a protocol when not in use even if restricted by IP address is the safest solution especially when it is not required for access.

Impact

N/A

Audit Procedure

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com
2. Click All services, click Lightsail under Compute.
3. This will open up the Lightsail console.
4. Select the Windows or Linux Instance you want to review.
5. Go to the Networking section.
6. If it is a Windows instance confirm that SSH has been removed. If it is a Linux instance confirm RDP has been removed.
7. If either still exists in the IPV4 Firewall list refer to the remediation below.
8. If the server needs HTTP, TCP Port 80 confirm that the application forwards Port 80 to HTTPS, TCP Port 443.
9. If the server does not need HTTP refer to the remediation below.
10. Confirm that there are no other unused or unneeded ports.
11. If the system has other ports that are not required or in use refer to the remediation below.

Using AWS CLI

1. Run aws lightsail get-instances

aws lightsail get-instances --query "instances[*].name"

This command will provide a list of Instance names.

2. Run aws lightsail get-instance-port-states for each instance listed above

aws lightsail get-instance-port-states --instance-name <instance_name>

This command will provide a list of available Ports for the Instance name.

Example output:

"portStates": [
    {
        "fromPort":