Skip to content

Commit cfa390f

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #107 from cloudgraphdev/feature/CG-1285-aws-cis-150-5.3
Feature/cg 1285 aws cis 150 5.3
2 parents 5930ceb + ca5d214 commit cfa390f

8 files changed

Lines changed: 1002 additions & 1 deletion

File tree

‎src/aws/cis-1.5.0/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,8 @@ Policy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d
104104
| AWS CIS 4.13 | Ensure a log metric filter and alarm exist for route table changes |
105105
| AWS CIS 4.14 | Ensure a log metric filter and alarm exist for VPC changes |
106106
| AWS CIS 4.15 | Ensure a log metric filter and alarm exists for AWS Organizations changes |
107+
| AWS CIS 5.1 | Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports |
108+
| AWS CIS 5.2 | Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports |
109+
| AWS CIS 5.3 | Ensure no security groups allow ingress from ::/0 to remote server administration ports |
110+
| AWS CIS 5.4 | Ensure the default security group of every VPC restricts all traffic |
111+
| AWS CIS 5.5 | Ensure routing tables for VPC peering are "least access" |

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.1.ts‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-5.1',
3+
title: 'AWS CIS 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports',
4+
5+
description: 'The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.',
6+
7+
audit: `**From Console:**
8+
Perform the following to determine if the account is configured as prescribed:
9+
10+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
11+
2. In the left pane, click *Network ACLs*
12+
3. For each network ACL, perform the following:
13+
- Select the network ACL
14+
- Click the *Inbound Rules* tab
15+
- Ensure no rule exists that has a port range that includes port *22*, *3389*, or other remote server administration ports for your environment and has a *Source* of *0.0.0.0/0* and shows *ALLOW*
16+
17+
**Note:** A Port value of *ALL* or a port range such as *0-1024* are inclusive of port *22*, *3389*, and other remote server administration ports`,
18+
19+
rationale: 'Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.',
20+
21+
remediation: `**From Console:**
22+
Perform the following:
23+
24+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
25+
2. In the left pane, click *Network ACLs*
26+
3. For each network ACL to remediate, perform the following:
27+
- Select the network ACL
28+
- Click the *Inbound Rules* tab
29+
- Click *Edit inbound rules*
30+
- Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click *Delete* to remove the offending inbound rule
31+
- Click *Save*`,
32+
33+
references: [
34+
'https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html',
35+
'https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison',
36+
],
37+
gql: `{
38+
queryawsNetworkAcl {
39+
id
40+
arn
41+
accountId
42+
__typename
43+
inboundRules {
44+
source
45+
fromPort
46+
toPort
47+
allowOrDeny
48+
}
49+
}
50+
}`,
51+
resource: 'queryawsNetworkAcl[*]',
52+
severity: 'high',
53+
conditions: {
54+
not: {
55+
path: '@.inboundRules',
56+
array_any: {
57+
and: [
58+
{
59+
path: '[*].source',
60+
in: ['0.0.0.0/0', '::/0'],
61+
},
62+
{
63+
path: '[*].allowOrDeny',
64+
equal: 'allow',
65+
},
66+
{
67+
or: [
68+
{
69+
and: [
70+
{
71+
path: '[*].fromPort',
72+
equal: null,
73+
},
74+
{
75+
path: '[*].toPort',
76+
equal: null,
77+
},
78+
],
79+
},
80+
{
81+
or: [
82+
{
83+
and: [
84+
{
85+
path: '[*].fromPort',
86+
lessThanInclusive: 22,
87+
},
88+
{
89+
path: '[*].toPort',
90+
greaterThanInclusive: 22,
91+
},
92+
],
93+
},
94+
{
95+
and: [
96+
{
97+
path: '[*].fromPort',
98+
lessThanInclusive: 3389,
99+
},
100+
{
101+
path: '[*].toPort',
102+
greaterThanInclusive: 3389,
103+
},
104+
],
105+
},
106+
]
107+
},
108+
],
109+
},
110+
],
111+
},
112+
},
113+
},
114+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.2.ts‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-5.2',
3+
title: 'AWS CIS 5.2 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports',
4+
5+
description: 'Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.',
6+
7+
audit: `Perform the following to determine if the account is configured as prescribed:
8+
9+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
10+
2. In the left pane, click *Security Groups*
11+
3. For each security group, perform the following:
12+
4. Select the security group
13+
5. Click the *Inbound Rules* tab
14+
6. Ensure no rule exists that has a port range that includes port *22*, *3389*, or other remote server administration ports for your environment and has a *Source* of *0.0.0.0/0*
15+
16+
**Note:** A Port value of *ALL* or a port range such as *0-1024* are inclusive of port *22*, *3389*, and other remote server administration ports.`,
17+
18+
rationale: 'Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.',
19+
20+
remediation: `Perform the following to implement the prescribed state:
21+
22+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
23+
2. In the left pane, click *Security Groups*
24+
3. For each security group, perform the following:
25+
4. Select the security group
26+
5. Click the *Inbound Rules* tab
27+
6. Click the *Edit inbound rules* button
28+
7. Identify the rules to be edited or removed
29+
8. Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click *Delete* to remove the offending inbound rule
30+
9. Click *Save rules*`,
31+
32+
references: ['https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule'],
33+
gql: `{
34+
queryawsSecurityGroup{
35+
id
36+
arn
37+
accountId
38+
__typename
39+
inboundRules{
40+
source
41+
toPort
42+
fromPort
43+
}
44+
}
45+
}`,
46+
resource: 'queryawsSecurityGroup[*]',
47+
severity: 'high',
48+
conditions: {
49+
not: {
50+
path: '@.inboundRules',
51+
array_any: {
52+
and: [
53+
{
54+
path: '[*].source',
55+
equal: '0.0.0.0/0',
56+
},
57+
{
58+
or: [
59+
{
60+
and: [
61+
{
62+
path: '[*].fromPort',
63+
equal: null,
64+
},
65+
{
66+
path: '[*].toPort',
67+
equal: null,
68+
},
69+
],
70+
},
71+
{
72+
or: [
73+
{
74+
and: [
75+
{
76+
path: '[*].fromPort',
77+
lessThanInclusive: 22,
78+
},
79+
{
80+
path: '[*].toPort',
81+
greaterThanInclusive: 22,
82+
},
83+
],
84+
},
85+
{
86+
and: [
87+
{
88+
path: '[*].fromPort',
89+
lessThanInclusive: 3389,
90+
},
91+
{
92+
path: '[*].toPort',
93+
greaterThanInclusive: 3389,
94+
},
95+
],
96+
},
97+
]
98+
},
99+
],
100+
},
101+
],
102+
},
103+
},
104+
},
105+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-5.3.ts‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-5.3',
3+
title: 'AWS CIS 5.3 Ensure no security groups allow ingress from ::/0 to remote server administration ports',
4+
5+
description: 'Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port *22* and RDP to port *3389*.',
6+
7+
audit: `Perform the following to determine if the account is configured as prescribed:
8+
9+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
10+
2. In the left pane, click *Security Groups*
11+
3. For each security group, perform the following:
12+
4. Select the security group
13+
5. Click the *Inbound Rules* tab
14+
6. Ensure no rule exists that has a port range that includes port 22, 3389, or other remote server administration ports for your environment and has a Source of ::/0
15+
16+
**Note:** A Port value of *ALL* or a port range such as *0-1024* are inclusive of port *22*, *3389*,
17+
and other remote server administration ports.`,
18+
19+
rationale: 'Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.',
20+
21+
remediation: `Perform the following to implement the prescribed state:
22+
23+
1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
24+
2. In the left pane, click *Security Groups*
25+
3. For each security group, perform the following:
26+
27+
Page 215
28+
29+
4. Select the security group
30+
5. Click the *Inbound Rules* tab
31+
6. Click the *Edit inbound rules* button
32+
7. Identify the rules to be edited or removed
33+
8. Either A) update the Source field to a range other than ::/0, or, B) Click *Delete* to remove the offending inbound rule
34+
9. Click *Save rules*`,
35+
36+
references: ['https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule'],
37+
gql: `{
38+
queryawsSecurityGroup{
39+
id
40+
arn
41+
accountId
42+
__typename
43+
inboundRules{
44+
source
45+
toPort
46+
fromPort
47+
}
48+
}
49+
}`,
50+
resource: 'queryawsSecurityGroup[*]',
51+
severity: 'high',
52+
conditions: {
53+
not: {
54+
path: '@.inboundRules',
55+
array_any: {
56+
and: [
57+
{
58+
path: '[*].source',
59+
equal: '::/0',
60+
},
61+
{
62+
or: [
63+
{
64+
and: [
65+
{
66+
path: '[*].fromPort',
67+
equal: null,
68+
},
69+
{
70+
path: '[*].toPort',
71+
equal: null,
72+
},
73+
],
74+
},
75+
{
76+
or: [
77+
{
78+
and: [
79+
{
80+
path: '[*].fromPort',
81+
lessThanInclusive: 22,
82+
},
83+
{
84+
path: '[*].toPort',
85+
greaterThanInclusive: 22,
86+
},
87+
],
88+
},
89+
{
90+
and: [
91+
{
92+
path: '[*].fromPort',
93+
lessThanInclusive: 3389,
94+
},
95+
{
96+
path: '[*].toPort',
97+
greaterThanInclusive: 3389,
98+
},
99+
],
100+
},
101+
]
102+
},
103+
],
104+
},
105+
],
106+
},
107+
},
108+
},
109+
}

0 commit comments

Comments
 (0)