Skip to content

Commit b758b72

Browse files
james-zhou-inspire11james-zhou-inspire11
committed
feat(CG-1284): add networking rule support
1 parent 4e80389 commit b758b72

7 files changed

Lines changed: 818 additions & 1 deletion

File tree

‎src/aws/cis-1.5.0/README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,4 +57,7 @@ Policy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d
5757

5858
| Rule | Description |
5959
| ------------- | --------------------------------------------------------------------------------------------------------------------------- |
60-
60+
| AWS CIS 5.1 | Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports |
61+
| AWS CIS 5.2 | Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports |
62+
| AWS CIS 5.4 | Ensure the default security group of every VPC restricts all traffic |
63+
| AWS CIS 5.5 | Ensure routing tables for VPC peering are "least access" |

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.1.ts‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-5.1',
3+
title: 'AWS CIS 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports',
4+
5+
description: 'The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.',
6+
7+
audit: `**From Console:**
8+
Perform the following to determine if the account is configured as prescribed:
9+
10+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
11+
2. In the left pane, click *Network ACLs*
12+
3. For each network ACL, perform the following:
13+
- Select the network ACL
14+
- Click the *Inbound Rules* tab
15+
- Ensure no rule exists that has a port range that includes port *22*, *3389*, or other remote server administration ports for your environment and has a *Source* of *0.0.0.0/0* and shows *ALLOW*
16+
17+
**Note:** A Port value of *ALL* or a port range such as *0-1024* are inclusive of port *22*, *3389*, and other remote server administration ports`,
18+
19+
rationale: 'Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.',
20+
21+
remediation: `**From Console:**
22+
Perform the following:
23+
24+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
25+
2. In the left pane, click *Network ACLs*
26+
3. For each network ACL to remediate, perform the following:
27+
- Select the network ACL
28+
- Click the *Inbound Rules* tab
29+
- Click *Edit inbound rules*
30+
- Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click *Delete* to remove the offending inbound rule
31+
- Click *Save*`,
32+
33+
references: [
34+
'https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html',
35+
'https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison',
36+
],
37+
gql: `{
38+
queryawsNetworkAcl {
39+
id
40+
arn
41+
accountId
42+
__typename
43+
inboundRules {
44+
source
45+
fromPort
46+
toPort
47+
allowOrDeny
48+
}
49+
}
50+
}`,
51+
resource: 'queryawsNetworkAcl[*]',
52+
severity: 'high',
53+
conditions: {
54+
not: {
55+
path: '@.inboundRules',
56+
array_any: {
57+
and: [
58+
{
59+
path: '[*].source',
60+
in: ['0.0.0.0/0', '::/0'],
61+
},
62+
{
63+
path: '[*].allowOrDeny',
64+
equal: 'allow',
65+
},
66+
{
67+
or: [
68+
{
69+
and: [
70+
{
71+
path: '[*].fromPort',
72+
equal: null,
73+
},
74+
{
75+
path: '[*].toPort',
76+
equal: null,
77+
},
78+
],
79+
},
80+
{
81+
or: [
82+
{
83+
and: [
84+
{
85+
path: '[*].fromPort',
86+
lessThanInclusive: 22,
87+
},
88+
{
89+
path: '[*].toPort',
90+
greaterThanInclusive: 22,
91+
},
92+
],
93+
},
94+
{
95+
and: [
96+
{
97+
path: '[*].fromPort',
98+
lessThanInclusive: 3389,
99+
},
100+
{
101+
path: '[*].toPort',
102+
greaterThanInclusive: 3389,
103+
},
104+
],
105+
},
106+
]
107+
},
108+
],
109+
},
110+
],
111+
},
112+
},
113+
},
114+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.2.ts‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-5.2',
3+
title: 'AWS CIS 5.2 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports',
4+
5+
description: 'Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.',
6+
7+
audit: `Perform the following to determine if the account is configured as prescribed:
8+
9+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
10+
2. In the left pane, click *Security Groups*
11+
3. For each security group, perform the following:
12+
4. Select the security group
13+
5. Click the *Inbound Rules* tab
14+
6. Ensure no rule exists that has a port range that includes port *22*, *3389*, or other remote server administration ports for your environment and has a *Source* of *0.0.0.0/0*
15+
16+
**Note:** A Port value of *ALL* or a port range such as *0-1024* are inclusive of port *22*, *3389*, and other remote server administration ports.`,
17+
18+
rationale: 'Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.',
19+
20+
remediation: `Perform the following to implement the prescribed state:
21+
22+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
23+
2. In the left pane, click *Security Groups*
24+
3. For each security group, perform the following:
25+
4. Select the security group
26+
5. Click the *Inbound Rules* tab
27+
6. Click the *Edit inbound rules* button
28+
7. Identify the rules to be edited or removed
29+
8. Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click *Delete* to remove the offending inbound rule
30+
9. Click *Save rules*`,
31+
32+
references: ['https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule'],
33+
gql: `{
34+
queryawsSecurityGroup{
35+
id
36+
arn
37+
accountId
38+
__typename
39+
inboundRules{
40+
source
41+
toPort
42+
fromPort
43+
}
44+
}
45+
}`,
46+
resource: 'queryawsSecurityGroup[*]',
47+
severity: 'high',
48+
conditions: {
49+
not: {
50+
path: '@.inboundRules',
51+
array_any: {
52+
and: [
53+
{
54+
path: '[*].source',
55+
in: ['0.0.0.0/0', '::/0'],
56+
},
57+
{
58+
or: [
59+
{
60+
and: [
61+
{
62+
path: '[*].fromPort',
63+
equal: null,
64+
},
65+
{
66+
path: '[*].toPort',
67+
equal: null,
68+
},
69+
],
70+
},
71+
{
72+
or: [
73+
{
74+
and: [
75+
{
76+
path: '[*].fromPort',
77+
lessThanInclusive: 22,
78+
},
79+
{
80+
path: '[*].toPort',
81+
greaterThanInclusive: 22,
82+
},
83+
],
84+
},
85+
{
86+
and: [
87+
{
88+
path: '[*].fromPort',
89+
lessThanInclusive: 3389,
90+
},
91+
{
92+
path: '[*].toPort',
93+
greaterThanInclusive: 3389,
94+
},
95+
],
96+
},
97+
]
98+
},
99+
],
100+
},
101+
],
102+
},
103+
},
104+
},
105+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.4.ts‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
// AWS CIS 1.2.0 Rule equivalent 4.3
2+
export default {
3+
id: 'aws-cis-1.5.0-5.3',
4+
title:
5+
'AWS CIS 5.3 Ensure the default security group of every VPC restricts all traffic',
6+
description: `A VPC comes with a default security group whose initial settings deny all inbound traffic,
7+
allow all outbound traffic, and allow all traffic between instances assigned to the security
8+
group. If you don't specify a security group when you launch an instance, the instance is
9+
automatically assigned to this default security group. Security groups provide stateful
10+
filtering of ingress/egress network traffic to AWS resources. It is recommended that the
11+
default security group restrict all traffic.
12+
13+
The default VPC in every region should have its default security group updated to comply.
14+
Any newly created VPCs will automatically contain a default security group that will need
15+
remediation to comply with this recommendation.
16+
17+
**NOTE:** When implementing this recommendation, VPC flow logging is invaluable in
18+
determining the least privilege port access required by systems to work properly because it
19+
can log all packet acceptances and rejections occurring under the current security groups.
20+
This dramatically reduces the primary barrier to least privilege engineering - discovering
21+
the minimum ports required by systems in the environment. Even if the VPC flow logging
22+
recommendation in this benchmark is not adopted as a permanent security measure, it
23+
should be used during any period of discovery and engineering for least privileged security
24+
groups.`,
25+
audit: `Perform the following to determine if the account is configured as prescribed:
26+
Security Group State
27+
28+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
29+
2. Repeat the next steps for all VPCs - including the default VPC in each AWS region:
30+
3. In the left pane, click *Security Groups*
31+
4. For each default security group, perform the following:
32+
5. Select the *default* security group
33+
6. Click the *Inbound Rules* tab
34+
7. Ensure no rule exist
35+
8. Click the *Outbound Rules* tab
36+
9. Ensure no rules exist
37+
38+
Security Group Members
39+
40+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
41+
2. Repeat the next steps for all default groups in all VPCs - including the default VPC in each AWS region:
42+
3. In the left pane, click *Security Groups*
43+
4. Copy the id of the default security group.
44+
5. Change to the EC2 Management Console at https://console.aws.amazon.com/ec2/v2/home
45+
6. In the filter column type 'Security Group ID : < security group id from #4 >`,
46+
rationale:
47+
'Configuring all VPC default security groups to restrict all traffic will encourage least privilege security group development and mindful placement of AWS resources into security groups which will, in turn, reduce the exposure of those resources.',
48+
remediation: `Security Group Members
49+
Perform the following to implement the prescribed state:
50+
51+
1. Identify AWS resources that exist within the default security group
52+
2. Create a set of least privilege security groups for those resources
53+
3. Place the resources in those security groups
54+
4. Remove the resources noted in #1 from the default security group
55+
56+
Security Group State
57+
58+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
59+
2. Repeat the next steps for all VPCs - including the default VPC in each AWS region:
60+
3. In the left pane, click *Security Groups*
61+
4. For each default security group, perform the following:
62+
5. Select the *default* security group
63+
6. Click the *Inbound Rules* tab
64+
7. Remove any inbound rules
65+
8. Click the *Outbound Rules* tab
66+
9. Remove any inbound rules
67+
68+
Recommended:
69+
IAM groups allow you to edit the "name" field. After remediating default groups rules for all VPCs in all regions, edit this field to add text similar to "DO NOT USE. DO NOT ADD RULES"`,
70+
references: [
71+
'CCE-79201-0',
72+
'http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html',
73+
'CIS CSC v6.0 #9.2',
74+
],
75+
gql: `{
76+
queryawsSecurityGroup(filter: { name: { eq: "default" } }) {
77+
id
78+
name
79+
arn
80+
accountId
81+
__typename
82+
inboundRules{
83+
source
84+
}
85+
outboundRules{
86+
destination
87+
}
88+
}
89+
}`,
90+
exclude: { not: { path: '@.name', equal: 'default' } },
91+
resource: 'queryawsSecurityGroup[*]',
92+
severity: 'high',
93+
conditions: {
94+
not: {
95+
or: [
96+
{
97+
path: '@.inboundRules',
98+
array_any: {
99+
path: '[*].source',
100+
in: ['0.0.0.0/0', '::/0'],
101+
},
102+
},
103+
{
104+
path: '@.outboundRules',
105+
array_any: {
106+
path: '[*].destination',
107+
in: ['0.0.0.0/0', '::/0'],
108+
},
109+
},
110+
],
111+
},
112+
},
113+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.5.ts‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-5.4',
3+
title:
4+
'AWS CIS 5.4 Ensure routing tables for VPC peering are "least access"',
5+
6+
description:
7+
'Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.',
8+
9+
audit: `Review routing tables of peered VPCs for whether they route all subnets of each VPC and whether that is necessary to accomplish the intended purposes for peering the VPCs.
10+
11+
**From Command Line:**
12+
13+
1. List all the route tables from a VPC and check if "GatewayId" is pointing to a <peering_connection_id> (e.g. pcx-1a2b3c4d) and if "DestinationCidrBlock" is as specific as desired.
14+
15+
aws ec2 describe-route-tables --filter "Name=vpc-id,Values=<vpc_id>" --query "RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[*].SubnetId}"`,
16+
17+
rationale:
18+
'Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC.',
19+
20+
remediation: `Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable.
21+
22+
**From Command Line:**
23+
24+
1. For each <route_table_id> containing routes non compliant with your routing policy (which grants more than desired "least access"), delete the non compliant route:
25+
26+
aws ec2 delete-route --route-table-id <route_table_id> --destination-cidr-block <non_compliant_destination_CIDR>
27+
28+
2. Create a new compliant route:
29+
30+
aws ec2 create-route --route-table-id <route_table_id> --destination-cidr-block <compliant_destination_CIDR> --vpc-peering-connection-id <peering_connection_id>`,
31+
32+
references: [
33+
'https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html',
34+
'https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc-peering-connection.html',
35+
],
36+
37+
severity: 'high',
38+
}

‎src/aws/cis-1.5.0/rules/index.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,11 @@
1+
import Aws_CIS_150_51 from './aws-cis-1.5.0-5.1'
2+
import Aws_CIS_150_52 from './aws-cis-1.5.0-5.2'
3+
import Aws_CIS_150_54 from './aws-cis-1.5.0-5.4'
4+
import Aws_CIS_150_55 from './aws-cis-1.5.0-5.5'
5+
16
export default [
7+
Aws_CIS_150_51,
8+
Aws_CIS_150_52,
9+
Aws_CIS_150_54,
10+
Aws_CIS_150_55,
211
]

0 commit comments

Comments
 (0)