An Elastic Compute Service (ECS) security group is compliant if its inbound CIDR block is not 0.0.0.0/0. If the CIDR block is 0.0.0.0/0, the security group is compliant only if the port range for the specified protocol does not include high-risk ports. The security group is also compliant if a higher-priority authorization policy denies the high-risk port.
Scenarios
Restrict security group authorization policies to minimize network exposure and protect your cloud environment.
Risk level
Default risk level: High.
You can change the risk level of this rule as needed.
Detection logic
-
Compliant: The inbound CIDR block of the security group is 0.0.0.0/0, and the port range for the specified protocol does not include high-risk ports.
-
Compliant: The inbound CIDR block of the security group is not 0.0.0.0/0, even if the port range for the specified protocol includes high-risk ports.
-
Compliant: A high-risk port is denied by an authorization policy with a higher priority.
-
Non-compliant: The inbound CIDR block of the security group is 0.0.0.0/0, and the port range for the specified protocol includes high-risk ports. For more information, see Remediation.
-
Not applicable: The security group is used by a cloud product or virtual operator.
Rule details
|
Parameter |
Description |
|
Rule name |
High-risk ports for a specified protocol must not be open to all CIDR blocks in a security group |
|
Rule identifier |
ecs-security-group-risky-ports-check-with-protocol |
|
Tag |
SecurityGroup |
|
Automatic remediation |
Not supported |
|
Rule trigger |
Configuration change |
|
Supported resource types |
ECS security group |
|
Input parameters |
|
Remediation
Modify the security group rules to exclude high-risk ports, or ensure that the high-risk ports are denied by an authorization policy with a higher priority. For more information, see Modify security group rules.