cis-aws-storage-2-2

name	cis-aws-storage-2.2
description	Ensure configuring Security Groups
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","ebs","ec2","security-group","firewall","network-security"]
cis_id	2.2
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	["CWE-284","CWE-923"]
chains_with	["cis-aws-storage-2.1","cis-aws-storage-2.3"]
prerequisites	["cis-aws-storage-2.1"]
severity_boost	{}

CIS Control 2.2: Ensure configuring Security Groups (Manual)

Profile Applicability

• Level 2

Description

Security groups are your first line of defense for the EC2 instance. A security group is a firewall that controls inbound and outbound traffic.

Rationale

Security groups play a critical role in maintaining the security of your AWS resources. It is advisable to restrict traffic to only what is necessary for accessing your instance, thereby minimizing potential security risks.

Properly configured security groups:

• Implement network-level access control
• Reduce attack surface by limiting exposed ports
• Enforce principle of least privilege for network access
• Provide stateful firewall protection

Impact

Improperly configured security groups can lead to:

• Unauthorized network access to EC2 instances
• Exposure of management ports (SSH, RDP) to the internet
• Data exfiltration through unrestricted outbound rules
• Lateral movement within VPC if rules are too permissive
• Compliance violations

Audit Procedure

Via AWS Management Console

Open traffic for SSH, HTTP, and HTTPS. Make sure to allow traffic from anywhere, unless you will be accessing the instance from a secure workstation or server with a static IP address.

1. Navigate to EC2 Dashboard → Security Groups
2. Review inbound rules for each security group
3. Check for overly permissive rules (0.0.0.0/0 on sensitive ports)
4. Verify outbound rules follow least privilege

Via AWS CLI

# List all security groups
aws ec2 describe-security-groups \
  --query 'SecurityGroups[].[GroupId,GroupName,VpcId]' \
  --output table

# Find security groups with SSH (22) open to the world
aws ec2 describe-security-groups \
  --filters Name=ip-permission.from-port,Values=22 \
  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]].[GroupId,GroupName]' \
  --output table

# Find security groups with RDP (3389) open to the world
aws ec2 describe-security-groups \
  --filters Name=ip-permission.from-port,Values=3389 \
  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]].[GroupId,GroupName]' \
  --output table

# Get detailed security group rules
aws ec2 describe-security-groups \
  --group-ids sg-xxxxxxxxx