Skip to content

Commit 6528999

Browse files
james-zhou-inspire11james-zhou-inspire11
committed
feat(CG-1285): add aws cis 150 5.3
1 parent b758b72 commit 6528999

5 files changed

Lines changed: 217 additions & 33 deletions

File tree

‎src/aws/cis-1.5.0/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,5 +59,6 @@ Policy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d
5959
| ------------- | --------------------------------------------------------------------------------------------------------------------------- |
6060
| AWS CIS 5.1 | Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports |
6161
| AWS CIS 5.2 | Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports |
62+
| AWS CIS 5.3 | Ensure no security groups allow ingress from ::/0 to remote server administration ports |
6263
| AWS CIS 5.4 | Ensure the default security group of every VPC restricts all traffic |
6364
| AWS CIS 5.5 | Ensure routing tables for VPC peering are "least access" |

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.2.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ export default {
3535
id
3636
arn
3737
accountId
38-
__typename
38+
__typename
3939
inboundRules{
4040
source
4141
toPort
@@ -52,7 +52,7 @@ export default {
5252
and: [
5353
{
5454
path: '[*].source',
55-
in: ['0.0.0.0/0', '::/0'],
55+
equal: '0.0.0.0/0',
5656
},
5757
{
5858
or: [

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.3.ts‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-5.3',
3+
title: 'AWS CIS 5.3 Ensure no security groups allow ingress from ::/0 to remote server administration ports',
4+
5+
description: 'Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port *22* and RDP to port *3389*.',
6+
7+
audit: `Perform the following to determine if the account is configured as prescribed:
8+
9+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
10+
2. In the left pane, click *Security Groups*
11+
3. For each security group, perform the following:
12+
4. Select the security group
13+
5. Click the *Inbound Rules* tab
14+
6. Ensure no rule exists that has a port range that includes port 22, 3389, or other remote server administration ports for your environment and has a Source of ::/0
15+
16+
**Note:** A Port value of *ALL* or a port range such as *0-1024* are inclusive of port *22*, *3389*,
17+
and other remote server administration ports.`,
18+
19+
rationale: 'Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.',
20+
21+
remediation: `Perform the following to implement the prescribed state:
22+
23+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
24+
2. In the left pane, click *Security Groups*
25+
3. For each security group, perform the following:
26+
27+
Page 215
28+
29+
4. Select the security group
30+
5. Click the *Inbound Rules* tab
31+
6. Click the *Edit inbound rules* button
32+
7. Identify the rules to be edited or removed
33+
8. Either A) update the Source field to a range other than ::/0, or, B) Click *Delete* to remove the offending inbound rule
34+
9. Click *Save rules*`,
35+
36+
references: ['https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule'],
37+
gql: `{
38+
queryawsSecurityGroup{
39+
id
40+
arn
41+
accountId
42+
__typename
43+
inboundRules{
44+
source
45+
toPort
46+
fromPort
47+
}
48+
}
49+
}`,
50+
resource: 'queryawsSecurityGroup[*]',
51+
severity: 'high',
52+
conditions: {
53+
not: {
54+
path: '@.inboundRules',
55+
array_any: {
56+
and: [
57+
{
58+
path: '[*].source',
59+
equal: '::/0',
60+
},
61+
{
62+
or: [
63+
{
64+
and: [
65+
{
66+
path: '[*].fromPort',
67+
equal: null,
68+
},
69+
{
70+
path: '[*].toPort',
71+
equal: null,
72+
},
73+
],
74+
},
75+
{
76+
or: [
77+
{
78+
and: [
79+
{
80+
path: '[*].fromPort',
81+
lessThanInclusive: 22,
82+
},
83+
{
84+
path: '[*].toPort',
85+
greaterThanInclusive: 22,
86+
},
87+
],
88+
},
89+
{
90+
and: [
91+
{
92+
path: '[*].fromPort',
93+
lessThanInclusive: 3389,
94+
},
95+
{
96+
path: '[*].toPort',
97+
greaterThanInclusive: 3389,
98+
},
99+
],
100+
},
101+
]
102+
},
103+
],
104+
},
105+
],
106+
},
107+
},
108+
},
109+
}

‎src/aws/cis-1.5.0/rules/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
import Aws_CIS_150_51 from './aws-cis-1.5.0-5.1'
22
import Aws_CIS_150_52 from './aws-cis-1.5.0-5.2'
3+
import Aws_CIS_150_53 from './aws-cis-1.5.0-5.3'
34
import Aws_CIS_150_54 from './aws-cis-1.5.0-5.4'
45
import Aws_CIS_150_55 from './aws-cis-1.5.0-5.5'
56

67
export default [
78
Aws_CIS_150_51,
89
Aws_CIS_150_52,
10+
Aws_CIS_150_53,
911
Aws_CIS_150_54,
1012
Aws_CIS_150_55,
1113
]

‎src/aws/cis-1.5.0/tests/aws-cis-1.5.0-5.x.test.ts‎

Lines changed: 103 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import { initRuleEngine } from '../../../utils/test'
44

55
import Aws_CIS_150_51 from '../rules/aws-cis-1.5.0-5.1'
66
import Aws_CIS_150_52 from '../rules/aws-cis-1.5.0-5.2'
7+
import Aws_CIS_150_53 from '../rules/aws-cis-1.5.0-5.3'
78
import Aws_CIS_150_54 from '../rules/aws-cis-1.5.0-5.4'
89

910
const ipV4WildcardAddress = '0.0.0.0/0'
@@ -255,9 +256,9 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
255256
await testRule(3389, 3389, '10.10.10.10/16', Result.PASS)
256257
})
257258

258-
test('No Security Issue when there is an inbound rule with IPv6 wildcard address and port 80', async () => {
259-
await testRule(80, 80, ipV6WildcardAddress, Result.PASS)
260-
})
259+
// test('No Security Issue when there is an inbound rule with IPv6 wildcard address and port 80', async () => {
260+
// await testRule(80, 80, ipV6WildcardAddress, Result.PASS)
261+
// })
261262

262263
test('No Security Issue when there is an inbound rule with a random IPv4 and a port range not including the port 22', async () => {
263264
await testRule(
@@ -277,33 +278,10 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
277278
)
278279
})
279280

280-
test('No Security Issue when there is an inbound rule with IPv6 wildcard address and a port range not including the port 22', async () => {
281-
await testRule(
282-
100,
283-
200,
284-
ipV6WildcardAddress,
285-
Result.PASS
286-
)
287-
})
288-
289-
test('No Security Issue when there is an inbound rule with IPv6 wildcard address and a port range not including the port 3389 (multiple values)', async () => {
290-
await testRule(
291-
1000,
292-
2000,
293-
ipV6WildcardAddress,
294-
Result.PASS,
295-
true
296-
)
297-
})
298-
299281
test('Security Issue when IPv4 wildcard address and port 22', async () => {
300282
await testRule(22, 22, ipV4WildcardAddress, Result.FAIL)
301283
})
302284

303-
test('Security Issue when IPv6 wildcard address and port 3389', async () => {
304-
await testRule(3389, 3389, ipV6WildcardAddress, Result.FAIL)
305-
})
306-
307285
test('Security Issue when IPv4 wildcard address and port 22 (multiple values)', async () => {
308286
await testRule(
309287
22,
@@ -333,6 +311,104 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
333311
)
334312
})
335313

314+
test('Security Issue when there is an inbound rule with IPv4 wildcard address and port range includes the port 22', async () => {
315+
await testRule(0, 100, ipV4WildcardAddress, Result.FAIL)
316+
})
317+
318+
test('No Security Issue when there is an inbound rule with security group as source', async () => {
319+
await testRule(null, null, 'sg-049c76f349f62e4eb', Result.PASS)
320+
})
321+
})
322+
323+
describe('AWS CIS 5.3 Ensure no security groups allow ingress from ::/0 to remote server administration ports', () => {
324+
const testRule = async (
325+
fromPort: number | null ,
326+
toPort: number | null,
327+
sourceAddress: string,
328+
expectedResult: Result,
329+
includeRandomValidData = false
330+
): Promise<void> => {
331+
// Arrange
332+
const validInboundRule = {
333+
toPort: 123,
334+
fromPort: 456,
335+
source: '10.10.10.10/16',
336+
}
337+
338+
const data: QueryResponse = {
339+
queryawsSecurityGroup: [
340+
{
341+
id: cuid(),
342+
inboundRules: [
343+
{
344+
toPort,
345+
fromPort,
346+
source: sourceAddress,
347+
},
348+
],
349+
},
350+
],
351+
}
352+
353+
if (includeRandomValidData) {
354+
data.queryawsSecurityGroup?.[0].inboundRules?.push(validInboundRule)
355+
data.queryawsSecurityGroup?.push({
356+
id: cuid(),
357+
inboundRules: [validInboundRule, validInboundRule],
358+
})
359+
}
360+
361+
// Act
362+
const [processedRule] = await rulesEngine.processRule(Aws_CIS_150_53 as Rule, { ...data })
363+
364+
// Asserts
365+
expect(processedRule.result).toBe(expectedResult)
366+
}
367+
368+
test('No Security Issue when there is an inbound rule with a random IPv4 address and port 22', async () => {
369+
await testRule(22, 22, '10.10.10.10/16', Result.PASS)
370+
})
371+
372+
test('No Security Issue when there is an inbound rule with a random IPv4 address and port 3389', async () => {
373+
await testRule(3389, 3389, '10.10.10.10/16', Result.PASS)
374+
})
375+
376+
test('No Security Issue when there is an inbound rule with IPv6 wildcard address and port 80', async () => {
377+
await testRule(80, 80, ipV6WildcardAddress, Result.PASS)
378+
})
379+
380+
test('No Security Issue when there is an inbound rule with a random IPv4 and a port range not including the port 22', async () => {
381+
await testRule(
382+
100,
383+
200,
384+
'10.10.10.10/16',
385+
Result.PASS
386+
)
387+
})
388+
389+
test('No Security Issue when there is an inbound rule with IPv6 wildcard address and a port range not including the port 22', async () => {
390+
await testRule(
391+
100,
392+
200,
393+
ipV6WildcardAddress,
394+
Result.PASS
395+
)
396+
})
397+
398+
test('No Security Issue when there is an inbound rule with IPv6 wildcard address and a port range not including the port 3389 (multiple values)', async () => {
399+
await testRule(
400+
1000,
401+
2000,
402+
ipV6WildcardAddress,
403+
Result.PASS,
404+
true
405+
)
406+
})
407+
408+
test('Security Issue when IPv6 wildcard address and port 3389', async () => {
409+
await testRule(3389, 3389, ipV6WildcardAddress, Result.FAIL)
410+
})
411+
336412
test('Security Issue when there is an inbound rule with IPv6 wildcard address and no port range is specified', async () => {
337413
await testRule(
338414
null,
@@ -342,10 +418,6 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
342418
)
343419
})
344420

345-
test('Security Issue when there is an inbound rule with IPv4 wildcard address and port range includes the port 22', async () => {
346-
await testRule(0, 100, ipV4WildcardAddress, Result.FAIL)
347-
})
348-
349421
test('Security Issue when there is an inbound rule with IPv6 wildcard address and port range includes the port 3389', async () => {
350422
await testRule(3000, 4000, ipV6WildcardAddress, Result.FAIL)
351423
})
@@ -355,7 +427,7 @@ describe('CIS Amazon Web Services Foundations: 1.4.0', () => {
355427
})
356428
})
357429

358-
describe('AWS CIS 5.3 Ensure the default security group of every VPC restricts all traffic', () => {
430+
describe('AWS CIS 5.4 Ensure the default security group of every VPC restricts all traffic', () => {
359431
const test53Rule = async (
360432
ingressSource: string,
361433
egressDestination: string,

0 commit comments

Comments
 (0)