AWS Security Group Restricts Access To CDE

Description

This policy validates that are considered part of the PCI CDE do not allow any access from public IP space.

Query · python

from ipaddress import ip_network


def policy(resource):

    for permission in resource["IpPermissions"] or []:
        # Check if any traffic is allowed from public IP space
        for ip_range in permission["IpRanges"] or []:
            if ip_range["CidrIp"] == "0.0.0.0/0" or not ip_network(ip_range["CidrIp"]).is_private:
                return False
        for ip_range in permission["Ipv6Ranges"] or []:
            if ip_range["CidrIpv6"] == "::/0" or not ip_network(ip_range["CidrIpv6"]).is_private:
                return False

    return True

Analyst notes

Remove any IP permissions allowing inbound traffic from Public IP space to the CDE.

Raw source AWS Security Group Restricts Access To CDE · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: policy
Filename: aws_security_group_restricts_access_to_cde.py
PolicyID: "AWS.SecurityGroup.RestrictsAccessToCDE"
DisplayName: "AWS Security Group Restricts Access To CDE"
Enabled: false
ResourceTypes:
  - AWS.EC2.SecurityGroup
Tags:
  - AWS
  - PCI
  - Initial Access:Exploit Public-Facing Application
Reports:
  PCI:
    - 1.3.2
    - 1.3.5
  MITRE ATT&CK:
    - TA0001:T1190
Severity: Medium
Description: >
  This policy validates that are considered part of the PCI CDE do not allow any access from public IP space.
Runbook: >
  Remove any IP permissions allowing inbound traffic from Public IP space to the CDE.
Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html
Tests:
  - Name: In Scope Security Group Restricts Access
    ExpectedResult: true
    Resource:
      {
        "Description": "example VPC security group",
        "GroupId": "sg-abc123",
        "GroupName": "default",
        "IpPermissions":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": null,
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs":
                [
                  {
                    "Description": null,
                    "GroupId": "sg-def123",
                    "GroupName": null,
                    "PeeringStatus": null,
                    "UserId": "123456789012",
                    "VpcId": null,
                    "VpcPeeringConnectionId": null,
                  },
                ],
            },
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "10.0.1.0/24", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs": null,
            },
          ],
        "IpPermissionsEgress":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "0.0.0.0/0", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs": null,
            },
          ],
        "OwnerId": "123456789012",
        "Tags": { "environment": "pci" },
        "VpcId": "vpc-abc111222333",
      }
  - Name: In Scope Security Group Does Not Restrict Access
    ExpectedResult: false
    Resource:
      {
        "Description": "example VPC security group",
        "GroupId": "sg-abc123",
        "GroupName": "default",
        "IpPermissions":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": null,
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs":
                [
                  {
                    "Description": null,
                    "GroupId": "sg-def123",
                    "GroupName": null,
                    "PeeringStatus": null,
                    "UserId": "123456789012",
                    "VpcId": null,
                    "VpcPeeringConnectionId": null,
                  },
                ],
            },
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "1.1.1.1/32", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs": null,
            },
          ],
        "IpPermissionsEgress":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "192.0.2.0/24", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs": null,
            },
          ],
        "OwnerId": "123456789012",
        "Tags": { "environment": "pci" },
        "VpcId": "vpc-abc111222333",
      }
  - Name: Out Of Scope Security Group Does Not Restrict Access
    ExpectedResult: true
    Resource:
      {
        "Description": "example VPC security group",
        "GroupId": "sg-abc123",
        "GroupName": "default",
        "IpPermissions":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": null,
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs":
                [
                  {
                    "Description": null,
                    "GroupId": "sg-def123",
                    "GroupName": null,
                    "PeeringStatus": null,
                    "UserId": "123456789012",
                    "VpcId": null,
                    "VpcPeeringConnectionId": null,
                  },
                ],
            },
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "192.0.2.0/24", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs": null,
            },
          ],
        "IpPermissionsEgress":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "192.0.2.0/24", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs": null,
            },
          ],
        "OwnerId": "123456789012",
        "Tags": { "environment": "dmz" },
        "VpcId": "vpc-abc111222333",
      }


# ------ paired body: aws_security_group_restricts_access_to_cde.py ------

from ipaddress import ip_network


def policy(resource):

    for permission in resource["IpPermissions"] or []:
        # Check if any traffic is allowed from public IP space
        for ip_range in permission["IpRanges"] or []:
            if ip_range["CidrIp"] == "0.0.0.0/0" or not ip_network(ip_range["CidrIp"]).is_private:
                return False
        for ip_range in permission["Ipv6Ranges"] or []:
            if ip_range["CidrIpv6"] == "::/0" or not ip_network(ip_range["CidrIpv6"]).is_private:
                return False

    return True

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.