| name | cis-aws-foundations-6.3 |
| description | Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports |
| category | cis-networking |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","networking","security-groups","vpc","ssh","rdp"] |
| cis_id | 6.3 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-6.2","cis-aws-foundations-6.4","cis-aws-foundations-6.5"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports
Description
Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port 22 and RDP on port 3389, using either the TCP (6), UDP (17), or ALL (-1) protocols.
Rationale
Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases the attack surface of resources and unnecessarily raises the risk of resource compromise.
Impact
When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the 0.0.0.0/0 inbound rule.
Audit Procedure
Using AWS Console
- Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
- In the left pane, click
Security Groups.
- For each security group, perform the following:
- Select the security group.
- Click the
Inbound Rules tab.
- Ensure that no rule exists which has a port range including port 22 or 3389, uses the protocols TCP (6), UDP (17), or ALL (-1), or other remote server administration ports for your environment, and has a
Source of 0.0.0.0/0.
Note:
- A port value of ALL or a port range such as 0-3389 includes port 22, 3389, and potentially other remote server administration ports.
- Security groups are stateful and do not support explicit DENY rules. Therefore, an "effective ruleset" approach (e.g., allowing ANY/ANY but denying specific ports) is not applicable. Any rule that allows 0.0.0.0/0 access to administrative ports is considered non-compliant and must be removed or restricted.
Using AWS CLI
- Check all security groups for insecure inbound rules allowing traffic from 0.0.0.0/0:
aws ec2 describe-security-group-rules --query 'SecurityGroupRules[?CidrIpv4 == "0.0.0.0/0" && IsEgress == `false`]' --output json
Expected Result
No security group should have inbound rules allowing traffic from 0.0.0.0/0 to port 22 or 3389.
Remediation
Using AWS Console
- Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
