用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-euc-2-8命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-aws-euc-2.8 |
| description | Ensure the default IP access control group is disassociated |
| category | cis-end-user-compute |
| version | 1.2.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","end-user-compute","workspaces","ip-access-control","firewall","network-security"] |
| cis_id | 2.8 |
| cis_benchmark | CIS AWS End User Compute Services Benchmark v1.2.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-euc-2.7","cis-aws-euc-2.9"] |
| prerequisites | [] |
| severity_boost | {} |
The default IP Access Control group allows all traffic. Once you create and attach an IP Access Control Group the default is disassociated.
IP Access Control group acts as a virtual firewall for your WorkSpaces allowing you to add your trusted networks.
IP access control groups do not allow the use of dynamic IP addresses when using a NAT gateway and additional configuration has to be considered.
Perform the following steps to review your Directory:
If an IP Access Control group doesn't exist follow the remediation below.
Run the describe-ip-groups command:
aws workspaces describe-ip-groups
Review the output for the name and the IP Access controls.
If an IP Access Control group doesn't exist refer to the remediation below.
Perform the steps below to create an IP Access control group:
When you are done adding rules,
Next Associate an IP Access Control Group with a Directory
Note: If you associate an IP access control group that has no rules with a directory, this blocks all access to all WorkSpaces.
Run the create-ip-group command:
aws workspaces create-ip-group --group-name name-of-group --user-rules ipRule=ipaddress_list
Associate an IP Access Control Group with a Directory
Run the 'associate-ip-groups' command:
aws workspaces associate-ip-groups --directory-id directory_ID --group-ids IDs_of_IP_access_ctrl_group
By default, this default group includes a default rule that allows users to access their WorkSpaces from anywhere. You cannot modify the default IP access control group for your directory. If you don't associate an IP access control group with your directory, the default group is used. If you associate an IP access control group with a directory, the default IP access control group is disassociated.
v8:
v7: