| name | cis-aws-storage-3.5 |
| description | Ensure using Security Groups for VPC to control EFS traffic |
| category | cis-storage-services |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","efs","security-groups","vpc","network-security","traffic-control"] |
| cis_id | 3.5 |
| cis_benchmark | CIS AWS Storage Services Benchmark v1.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-storage-3.4","cis-aws-storage-3.6","cis-aws-storage-3.8"] |
| prerequisites | [] |
| severity_boost | {} |
3.5 Ensure using Security Groups for VPC (Manual)
Profile Applicability
Description
A security group controls the traffic that is allowed to reach and leave the resources that it is associated with. For example, after you associate a security group with an EC2 instance, it controls the inbound and outbound traffic for the instance.
Rationale
Security groups act as virtual firewalls to control network traffic to EFS mount targets, ensuring only authorized traffic can access the file system.
Impact
Without properly configured security groups, EFS mount targets may be exposed to unauthorized network access, potentially leading to data breaches or service disruptions.
Audit Procedure
Console
- Go to https://console.aws.amazon.com/vpc/
- Navigate to Security Groups and select on the VPC that houses your mount target.
- Ensure that incoming traffic is restricted to SSH access on port 22 using TCP protocol and outbound traffic is accepting all traffic.
Expected Result
- Security Groups should be configured to allow only necessary inbound traffic (e.g., SSH on port 22)
- Outbound traffic rules should be appropriately configured
- Security Groups should follow least privilege principle
Remediation
Console
Configure security groups to restrict traffic appropriately:
- Navigate to VPC console
- Select Security Groups
- Configure inbound rules to allow only necessary traffic (e.g., SSH on port 22 using TCP)
- Configure outbound rules as needed
- Apply security groups to EFS mount targets
Default Value
By default, the default security group for a VPC allows all inbound traffic from instances assigned to the same security group and all outbound traffic. Custom security groups must be explicitly configured for EFS mount targets.
References
- https://console.aws.amazon.com/vpc/
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 6.7 Centralize Access Control
Centralize access control for all enterprise assets through a directory service or SSO provider, where supported. | | ● | ● |
|
