Skip to content

Latest commit

 

History

History
31 lines (27 loc) · 3.48 KB

overlapping-security-groups.md

File metadata and controls

31 lines (27 loc) · 3.48 KB
Raw

CloudSploit

AWS / EC2 / Overlapping Security Groups

Quick Info
Plugin Title Overlapping Security Groups
Cloud AWS
Category EC2
Description Determine if EC2 instances have security groups that share the same rules
More Info Overlapping security group rules make managing EC2 instance access much more difficult. If a rule is removed from one security group, the access may still remain in another, resulting in unintended access to the instance.
AWS Link http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html
Recommended Action Structure security groups to provide a single category of access and do not duplicate rules across groups used by the same instances.

Detailed Remediation Steps

  1. Log into the AWS Management Console.
  2. Select the "Services" option and search for EC2.
  3. Scroll down the left navigation panel and choose "Security Groups" under "Network & Security".
  4. Select the "Security Group" that needs to be verified and scroll down and click on the "Description" tab and copy "Group ID".
  5. Navigate to the "EC2 dashboard" and on the "Filter by tags and attributes or search by keyword" box select for the "Security Group ID" from the dropdown menu and paste the "Group ID" copied above.
  6. Check the number of "EC2 Instance(s)" using the Security Group and if there are more than 1 instances sharing the same "Security Group" then it's not according to the standard practice of AWS.
  7. Repeat steps number 2 - 6 to verify other "EC2 Instances" using same "Security Group".
  8. Navigate to "Security Group" under "Network & Security" and click on the "Create Security Group" at the top.
  9. On the "Create Security Group" panel provide a "Security Group Name" and "Description" for the new "Security Group".Select the "VPC" to which "Security Group" belongs.
  10. Select the "Inbound Traffic Rules" by clicking on the "Add Rules" button and select the "Protocols" as per the requirement.
  11. Click on the "Create" button at the bottom to create a new "Security Group".
  12. Navigate to "EC2 dahsboard" and select the "Instance(s)" which are sharing the same "Security Group". Click on the "Actions" button at the top and click on the "Change Security Groups" under "Networking".
  13. On the "Change Security Groups" tab select the new "Security Group" and click on the "Assign Security Groups" button to assign the selected "Security Group" to the "EC2 Instance".
  14. Reepat steps number 8 - 13 to structure security groups and to avoid twin rules across "EC2 Instances".