AWS Security Group Tightly Restricts Outbound Traffic

AnalysisType: policy
Filename: aws_security_group_tightly_restricts_outbound_traffic.py
PolicyID: "AWS.SecurityGroup.TightlyRestrictsOutboundTraffic"
DisplayName: "AWS Security Group Tightly Restricts Outbound Traffic"
Enabled: false
ResourceTypes:
  - AWS.EC2.SecurityGroup
Tags:
  - AWS
  - PCI
  - Exfiltration:Exfiltration Over Web Service
Reports:
  PCI:
    - 1.1.4
  MITRE ATT&CK:
    - TA0010:T1567
Severity: Low
Description: >
  This policy validates that Security Groups have restrictive controls on outbound traffic.
Runbook: >
  Add appropriate restrictions to outbound traffic on Security Groups via IP permissions
Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html
Tests:
  - Name: Security Group Tightly Restricts Outbound Traffic
    ExpectedResult: true
    Resource:
      {
        "Description": "example VPC security group",
        "GroupId": "sg-abc123",
        "GroupName": "default",
        "IpPermissions":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": null,
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs":
                [
                  {
                    "Description": null,
                    "GroupId": "sg-def123",
                    "GroupName": null,
                    "PeeringStatus": null,
                    "UserId": "123456789012",
                    "VpcId": null,
                    "VpcPeeringConnectionId": null,
                  },
                ],
            },
          ],
        "IpPermissionsEgress":
          [
            {
              "FromPort": 2222,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "0.0.0.0/0", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": 2222,
              "UserIdGroupPairs": null,
            },
          ],
        "OwnerId": "123456789012",
        "Tags": { "environment": "pci" },
        "VpcId": "vpc-abc111222333",
      }
  - Name: Security Group Does Not Restrict Outbound Traffic
    ExpectedResult: false
    Resource:
      {
        "Description": "example VPC security group",
        "GroupId": "sg-abc123",
        "GroupName": "default",
        "IpPermissions":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": null,
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs":
                [
                  {
                    "Description": null,
                    "GroupId": "sg-def123",
                    "GroupName": null,
                    "PeeringStatus": null,
                    "UserId": "123456789012",
                    "VpcId": null,
                    "VpcPeeringConnectionId": null,
                  },
                ],
            },
          ],
        "IpPermissionsEgress":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "0.0.0.0/0", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs": null,
            },
          ],
        "OwnerId": "123456789012",
        "Tags": { "environment": "pci" },
        "VpcId": "vpc-abc111222333",
      }
  - Name: Security Group Does Not Tightly Restrict Outbound Traffic
    ExpectedResult: false
    Resource:
      {
        "Description": "example VPC security group",
        "GroupId": "sg-abc123",
        "GroupName": "default",
        "IpPermissions":
          [
            {
              "FromPort": null,
              "IpProtocol": "-1",
              "IpRanges": null,
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": null,
              "UserIdGroupPairs":
                [
                  {
                    "Description": null,
                    "GroupId": "sg-def123",
                    "GroupName": null,
                    "PeeringStatus": null,
                    "UserId": "123456789012",
                    "VpcId": null,
                    "VpcPeeringConnectionId": null,
                  },
                ],
            },
          ],
        "IpPermissionsEgress":
          [
            {
              "FromPort": 80,
              "IpProtocol": "-1",
              "IpRanges": [{ "CidrIp": "0.0.0.0/0", "Description": null }],
              "Ipv6Ranges": null,
              "PrefixListIds": null,
              "ToPort": 443,
              "UserIdGroupPairs": null,
            },
          ],
        "OwnerId": "123456789012",
        "Tags": { "environment": "pci" },
        "VpcId": "vpc-abc111222333",
      }


# ------ paired body: aws_security_group_tightly_restricts_outbound_traffic.py ------

MAX_PORTS_PER_PERMISSION = 10
RESTRICTED_PORTS = [
    21,  # FTP default
    22,  # SSH default
    23,  # Telnet default
    3389,  # RDP default
]


def policy(resource):
    if resource["IpPermissionsEgress"] is None:
        return True

    for permission in resource["IpPermissionsEgress"]:
        # Check if the permission is set to "All Ports"
        if permission["FromPort"] is None or permission["ToPort"] is None:
            return False
        # Check if the permission allows too many ports
        if permission["ToPort"] - permission["FromPort"] > MAX_PORTS_PER_PERMISSION:
            return False
        # Check if the permission allows too many ports. Alternatively, this can be modified to sum
        # open ports to have one running total.
        if permission["ToPort"] - permission["FromPort"] > MAX_PORTS_PER_PERMISSION:
            return False
        if any(permission["FromPort"] <= port <= permission["ToPort"] for port in RESTRICTED_PORTS):
            return False

    return True