Skip to content

Commit 6328c5d

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #109 from cloudgraphdev/feature/CG-1288-support-aws-cis-233
Feature/cg 1288 support aws cis 233
2 parents 3bd77e0 + 71df562 commit 6328c5d

4 files changed

Lines changed: 163 additions & 0 deletions

File tree

‎src/aws/cis-1.5.0/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ Policy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d
8686
| AWS CIS 2.2.1 | Ensure EBS volume encryption is enabled |
8787
| AWS CIS 2.3.1 | Ensure that encryption is enabled for RDS Instances |
8888
| AWS CIS 2.3.2 | Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances |
89+
| AWS CIS 2.3.3 | Ensure that public access is not given to RDS Instance |
8990
| AWS CIS 3.1 | Ensure CloudTrail is enabled in all regions |
9091
| AWS CIS 3.2 | Ensure CloudTrail log file validation is enabled |
9192
| AWS CIS 3.3 | Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible |

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-2.3.3.ts‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-2.3.3',
3+
title: 'AWS CIS 2.3.3 Ensure that public access is not given to RDS Instance',
4+
5+
description: 'Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.',
6+
7+
audit: `**From Console:**
8+
9+
1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
10+
2. Under the navigation panel, On RDS Dashboard, click *Databases*.
11+
3. Select the RDS instance that you want to examine.
12+
4. Click *Instance Name* from the dashboard, Under 'Connectivity and Security.
13+
5. On the *Security*, check if the Publicly Accessible flag status is set to *Yes*, follow the below-mentioned steps to check database subnet access.
14+
15+
• In the *networking* section, click the subnet link available under *Subnets*
16+
• The link will redirect you to the VPC Subnets page.
17+
• Select the subnet listed on the page and click the *Route Table* tab from the dashboard bottom panel. If the route table contains any entries with the destination *CIDR block set to 0.0.0.0/0* and with an *Internet Gateway* attached.
18+
• The selected RDS database instance was provisioned inside a public subnet, therefore is not running within a logically isolated environment and can be accessible from the Internet.
19+
20+
6. Repeat steps no. 4 and 5 to determine the type (public or private) and subnet for other RDS database instances provisioned in the current region.
21+
7. Change the AWS region from the navigation bar and repeat the audit process for other regions.
22+
23+
**From Command Line:**
24+
25+
1. Run *describe-db-instances* command to list all RDS database names, available in the selected AWS region:
26+
27+
aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier'
28+
29+
2. The command output should return each database instance *identifier*.
30+
3. Run again *describe-db-instances* command using the *PubliclyAccessible* parameter as query filter to reveal the database instance Publicly Accessible flag status:
31+
32+
aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-name> --query 'DBInstances[*].PubliclyAccessible'
33+
34+
4. Check for the Publicly Accessible parameter status, If the Publicly Accessible flag is set to *Yes*. Then selected RDS database instance is publicly accessible and insecure, follow the below-mentioned steps to check database subnet access
35+
5. Run again *describe-db-instances* command using the RDS database instance identifier that you want to check and appropriate filtering to describe the VPC subnet(s) associated with the selected instance:
36+
37+
aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].DBSubnetGroup.Subnets[]'
38+
39+
• The command output should list the subnets available in the selected database subnet group.
40+
41+
6. Run *describe-route-tables* command using the ID of the subnet returned at the previous step to describe the routes of the VPC route table associated with the selected subnet:
42+
43+
aws ec2 describe-route-tables --region <region-name> --filters "Name=association.subnet-id,Values=<SubnetID>" --query 'RouteTables[*].Routes[]'
44+
45+
• If the command returns the route table associated with database instance subnet ID. Check the *GatewayId* and *DestinationCidrBlock* attributes values returned in the output. If the route table contains any entries with the *GatewayId* value set to *igw-xxxxxxxx* and the *DestinationCidrBlock* value set to *0.0.0.0/0*, the selected RDS database instance was provisioned inside a public subnet.
46+
• Or
47+
• If the command returns empty results, the route table is implicitly associated with subnet, therefore the audit process continues with the next step
48+
49+
7. Run again *describe-db-instances* command using the RDS database instance identifier that you want to check and appropriate filtering to describe the VPC ID associated with the selected instance:
50+
51+
aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].DBSubnetGroup.VpcId'
52+
53+
• The command output should show the VPC ID in the selected database subnet group
54+
55+
8. Now run *describe-route-tables* command using the ID of the VPC returned at the previous step to describe the routes of the VPC main route table implicitly associated with the selected subnet:
56+
57+
aws ec2 describe-route-tables --region <region-name> --filters "Name=vpc-id,Values=<VPC-ID>" "Name=association.main,Values=true" --query 'RouteTables[*].Routes[]'
58+
59+
• The command output returns the VPC main route table implicitly associated with database instance subnet ID. Check the *GatewayId* and *DestinationCidrBlock* attributes values returned in the output. If the route table contains any entries with the *GatewayId* value set to *igw-xxxxxxxx* and the *DestinationCidrBlock* value set to *0.0.0.0/0*, the selected RDS database instance was provisioned inside a public subnet, therefore is not running within a logically isolated environment and does not adhere to AWS security best practices.`,
60+
61+
rationale: 'Ensure that no public-facing RDS database instances are provisioned in your AWS account and restrict unauthorized access in order to minimize security risks. When the RDS instance allows unrestricted access (0.0.0.0/0), everyone and everything on the Internet can establish a connection to your database and this can increase the opportunity for malicious activities such as brute force attacks, PostgreSQL injections, or DoS/DDoS attacks.',
62+
63+
remediation: `**From Console:**
64+
1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
65+
2. Under the navigation panel, On RDS Dashboard, click *Databases*.
66+
3. Select the RDS instance that you want to update.
67+
4. Click *Modify* from the dashboard top menu.
68+
5. On the Modify DB Instance panel, under the *Connectivity* section, click on *Additional connectivity configuration* and update the value for *Publicly Accessible* to Not publicly accessible to restrict public access. Follow the below steps to update subnet configurations:
69+
70+
• Select the *Connectivity and security* tab, and click on the VPC attribute value inside the *Networking* section.
71+
• Select the *Details* tab from the VPC dashboard bottom panel and click on Route table configuration attribute value.
72+
• On the Route table details page, select the Routes tab from the dashboard bottom panel and click on *Edit routes*.
73+
• On the Edit routes page, update the Destination of Target which is set to *igw-xxxxx* and click on *Save* routes.
74+
75+
6. On the Modify DB Instance panel Click on *Continue* and In the Scheduling of modifications section, perform one of the following actions based on your requirements:
76+
77+
• Select Apply during the next scheduled maintenance window to apply the changes automatically during the next scheduled maintenance window.
78+
• Select Apply immediately to apply the changes right away. With this option, any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window setting for this RDS database instance. Note that any changes available in the pending modifications queue are also applied. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for the application.
79+
80+
7. Repeat steps 3 to 6 for each RDS instance available in the current region.
81+
8. Change the AWS region from the navigation bar to repeat the process for other regions.
82+
83+
**From Command Line:**
84+
85+
1. Run *describe-db-instances* command to list all RDS database names identifiers, available in the selected AWS region:
86+
87+
aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier'
88+
89+
2. The command output should return each database instance identifier.
90+
3. Run *modify-db-instance* command to modify the selected RDS instance configuration. Then use the following command to disable the *Publicly Accessible* flag for the selected RDS instances. This command use the apply- immediately flag. If you want *to avoid any downtime --no-apply-immediately flag can be used*:
91+
92+
aws rds modify-db-instance --region <region-name> --db-instance-identifier <db-name> --no-publicly-accessible --apply-immediately
93+
94+
4. The command output should reveal the *PubliclyAccessible* configuration under pending values and should get applied at the specified time.
95+
5. Updating the Internet Gateway Destination via AWS CLI is not currently supported To update information about Internet Gateway use the AWS Console Procedure.
96+
6. Repeat steps 1 to 5 for each RDS instance provisioned in the current region.
97+
7. Change the AWS region by using the --region filter to repeat the process for other regions.`,
98+
99+
references: [
100+
'https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html',
101+
'https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html',
102+
'https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html',
103+
'https://aws.amazon.com/rds/faqs/',
104+
],
105+
gql: `{
106+
queryawsRdsDbInstance {
107+
id
108+
arn
109+
accountId
110+
__typename
111+
publiclyAccessible
112+
}
113+
}`,
114+
resource: 'queryawsRdsDbInstance[*]',
115+
severity: 'high',
116+
conditions: {
117+
path: '@.publiclyAccessible',
118+
equal: false,
119+
},
120+
}

‎src/aws/cis-1.5.0/rules/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import Aws_CIS_150_215 from './aws-cis-1.5.0-2.1.5'
2727
import Aws_CIS_150_221 from './aws-cis-1.5.0-2.2.1'
2828
import Aws_CIS_150_231 from './aws-cis-1.5.0-2.3.1'
2929
import Aws_CIS_150_232 from './aws-cis-1.5.0-2.3.2'
30+
import Aws_CIS_150_233 from './aws-cis-1.5.0-2.3.3'
3031
import Aws_CIS_150_31 from './aws-cis-1.5.0-3.1'
3132
import Aws_CIS_150_32 from './aws-cis-1.5.0-3.2'
3233
import Aws_CIS_150_33 from './aws-cis-1.5.0-3.3'
@@ -89,6 +90,7 @@ export default [
8990
Aws_CIS_150_221,
9091
Aws_CIS_150_231,
9192
Aws_CIS_150_232,
93+
Aws_CIS_150_233,
9294
Aws_CIS_150_31,
9395
Aws_CIS_150_32,
9496
Aws_CIS_150_33,

‎src/aws/cis-1.5.0/tests/aws-cis-1.5.0-2.x.test.ts‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,13 @@ import Aws_CIS_150_213 from '../rules/aws-cis-1.5.0-2.1.3'
77
import Aws_CIS_150_215 from '../rules/aws-cis-1.5.0-2.1.5'
88
import Aws_CIS_150_231 from '../rules/aws-cis-1.5.0-2.3.1'
99
import Aws_CIS_150_232 from '../rules/aws-cis-1.5.0-2.3.2'
10+
import Aws_CIS_150_233 from '../rules/aws-cis-1.5.0-2.3.3'
1011

1112
export interface QueryawsRdsDbInstance {
1213
id: string
1314
encrypted?: boolean
1415
autoMinorVersionUpgrade?: boolean
16+
publiclyAccessible?: boolean
1517
}
1618

1719
export interface EncryptionRule {
@@ -316,4 +318,42 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
316318
await testRule(data, Result.FAIL)
317319
})
318320
})
321+
322+
describe('AWS CIS 2.3.3 Ensure that public access is not given to RDS Instance', () => {
323+
const getTestRuleFixture = (publiclyAccessible: boolean): CIS2xQueryResponse => {
324+
return {
325+
queryawsRdsDbInstance: [
326+
{
327+
id: cuid(),
328+
publiclyAccessible,
329+
},
330+
],
331+
}
332+
}
333+
334+
// Act
335+
const testRule = async (
336+
data: CIS2xQueryResponse,
337+
expectedResult: Result
338+
): Promise<void> => {
339+
// Act
340+
const [processedRule] = await rulesEngine.processRule(
341+
Aws_CIS_150_233 as Rule,
342+
{ ...data }
343+
)
344+
345+
// Asserts
346+
expect(processedRule.result).toBe(expectedResult)
347+
}
348+
349+
test('No Security Issue when public access is not given to RDS instances', async () => {
350+
const data: CIS2xQueryResponse = getTestRuleFixture(false)
351+
await testRule(data, Result.PASS)
352+
})
353+
354+
test('Security Issue when public access is given to RDS instances', async () => {
355+
const data: CIS2xQueryResponse = getTestRuleFixture(true)
356+
await testRule(data, Result.FAIL)
357+
})
358+
})
319359
})

0 commit comments

Comments
 (0)