# 5.4 Ensure No Security Groups Allow Ingress from ::/0 to Remote Server Administration Ports (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233115-5-4-ensure-no-security-groups-allow-ingress-from-0-to-remote-server-administration-ports-automate - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 5](https://support.icompaas.com/support/solutions/folders/62000169192) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** **Description:** Security Groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress (::/0) to remote server administration ports, such as: - SSH (Port 22) - RDP (Port 3389) Allowing public access to these ports increases the risk of unauthorized access and potential compromise of resources. ## Rationale: Exposing remote administration ports (e.g., 22 for SSH, 3389 for RDP) to the entire internet (::/0) significantly increases attack vectors such as: - Brute force attacks on SSH and RDP services. - Unauthorized access to servers, leading to data breaches. - Automated scanning and exploitation by threat actors. Organizations should restrict remote administration to trusted IP addresses or use VPNs, bastion hosts, or AWS Session Manager for secure access. ## Impact: - If unrestricted access (::/0) is removed, ensure that administrators have an alternative mechanism (e.g., VPN, jump servers, AWS Systems Manager) to maintain access. - Without an alternative, administrators may lose remote access to manage AWS instances. Default Value: By default, AWS does not open SSH (22) or RDP (3389) to ::/0 when creating security groups. However, users often add overly permissive rules manually. ## Pre-Requisites: 1. AWS CLI Installed (for command-line operations). 2. IAM Permissions Required: - ec2:DescribeSecurityGroups (for auditing). - ec2:RevokeSecurityGroupIngress (for removing non-compliant rules). 3. Alternative Access Mechanism available to prevent lockout, such as: - AWS Systems Manager (Session Manager) - VPN Gateway - Bastion Host (Jump Server) 4. Security Group Review Process established before modifications. ## Remediation: ### Test Plan: ## Using AWS Console 1. Sign in to the AWS Management Console. 2. Navigate to the VPC Dashboard: [AWS VPC Console](https://console.aws.amazon.com/vpc/). 3. In the left navigation panel, select Security Groups. 4. For each security group: - Select the security group. - Click the Inbound Rules tab. - Identify rules with: - Port range: 22 (SSH) or 3389 (RDP) and Source: ::/0 (IPv6) Implementation Steps: Using AWS Console 1. Sign in to the AWS Management Console. 2. Navigate to the VPC Dashboard: [AWS VPC Console](https://console.aws.amazon.com/vpc/). ![](https://support.icompaas.com/assets/kb/c39732960fd324ae.png) 3. In the left navigation panel, select Security Groups. 4. For each security group: - Select the security group. ![](https://support.icompaas.com/assets/kb/b6d22c377ce97b6b.png) - Click Edit inbound rules. ![](https://support.icompaas.com/assets/kb/5a3ed12bc147087a.png) - Identify rules with: - Port 22 or 3389 - Source: ::/0 ![](https://support.icompaas.com/assets/kb/b13da5be0cc57380.png) - Update the source field to a trusted IP range (e.g., corporate VPN or jump server). - OR Delete the rule if unnecessary. ![](https://support.icompaas.com/assets/kb/6e8148208ff2045c.png) - Click Save rules. ![](https://support.icompaas.com/assets/kb/fbbb48f04c914063.png) ## Backout Plan: If necessary access is lost: 1. Restore a temporary security group rule allowing access from a specific trusted IP: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 22 --cidr /32 2. Ensure AWS Systems Manager is enabled for future remote access. 3. Implement a bastion host or VPN before removing wide-open access again. ## References: - [AWS EC2 Security Groups Documentation ](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.5

Implement and manage a firewall with a default-deny rule

CIS v7

9.4

Apply host-based firewalls or port filtering

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.