Skip to main content

How to Find AWS EC2 Security Group allows ingress from Everywhere to SSH port 22

Problem​

If Security groups are not properly configured the attack surface is increased.

info

This security check is part of the CIS Amazon Web Services Benchmarks and is rated severity high.

Prerequisites​

This guide assumes that you have already installed and configured Resoto to collect your AWS cloud resources.

Directions​

  1. Execute the following search command in Resoto Shell or Resoto UI:

    > search is(aws_ec2_security_group) and group_ip_permissions[*].{(ip_protocol=-1 or (from_port>=22 and to_port<=22 and ip_protocol=tcp)) and (ip_ranges[*].cidr_ip="0.0.0.0/0" or ipv6_ranges[*].cidr_ipv6="::/0")}
    ​kind=aws_ec2_security_group, ..., region=resoto-poweruser
    ​kind=aws_ec2_security_group, ..., account=poweruser-team

  2. Pipe the search command into the dump command:

    > search is(aws_ec2_security_group) and group_ip_permissions[*].{(ip_protocol=-1 or (from_port>=22 and to_port<=22 and ip_protocol=tcp)) and (ip_ranges[*].cidr_ip="0.0.0.0/0" or ipv6_ranges[*].cidr_ipv6="::/0")} | dump
    ​reported:
    ​  id: /aws/ec2/123
    ​  name: some-name
    ​  ctime: '2022-12-05T22:53:14Z'
    ​  kind: aws_ec2_security_group
    ​  age: 2mo28d

    The command output will list the details of all non-compliant aws_ec2_security_group resources.

  3. Fix detected issues by following the remediation steps:

    • Apply Zero Trust approach.
    • Implement a process to scan and remediate unrestricted or overly permissive network acls.
    • Recommended best practices is to narrow the definition for the minimum ports required.
    note

    Please refer to the AWS EC2 documentation for details.

Further Reading​