cis-aws-foundations-6-4

name	cis-aws-foundations-6.4
description	Ensure no security groups allow ingress from ::/0 to remote server administration ports
category	cis-networking
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","networking","security-groups","vpc","ssh","rdp","ipv6"]
cis_id	6.4
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-6.2","cis-aws-foundations-6.3","cis-aws-foundations-6.5"]
prerequisites	[]
severity_boost	{}

Ensure no security groups allow ingress from ::/0 to remote server administration ports

Description

Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port 22 and RDP on port 3389, using either the TCP (6), UDP (17), or ALL (-1) protocols.

Rationale

Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases attack surface of resources and unnecessarily raises the risk of resource compromise.

Impact

When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the ::/0 inbound rule.

Audit Procedure

Using AWS Console

1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
2. In the left pane, click Security Groups.
3. For each security group, perform the following:
   • Select the security group.
   • Click the Inbound Rules tab.
   • Ensure that no rule exists which has a port range including port 22, 3389, or other remote server administration ports for your environment, and has a Source of ::/0.

Note:

• A port value of ALL or a port range such as 0-3389 includes port 22, 3389, and potentially other remote server administration ports.
• Security groups are stateful and do not support explicit DENY rules. Therefore, an "effective ruleset" approach (e.g., allowing ANY/ANY but denying specific ports) is not applicable. Any rule that allows ::/0 access to administrative ports is considered non-compliant and must be removed or restricted.

Using AWS CLI

1. Check all security groups for insecure inbound rules that allow traffic from ::/0:

aws ec2 describe-security-group-rules --query 'SecurityGroupRules[?CidrIpv6 == `::/0` && IsEgress == `false`]' --output json

Expected Result

No security group should have inbound rules allowing traffic from ::/0 to port 22 or 3389.

Remediation

Using AWS Console

1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
2. In the left pane, click .