# Ensure RDP is Restricted to Only IP Address That Should Have This Access (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000234149-ensure-rdp-is-restricted-to-only-ip-address-that-should-have-this-access-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/62000112682) › [AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/folders/62000169228) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** Level 1 ### **Description:** Remote Desktop Protocol (RDP) is often used to remotely access Windows-based instances in AWS. However, RDP access should be restricted to only trusted IP addresses to minimize exposure and reduce the risk of unauthorized access. By restricting RDP access to specific IP addresses or ranges, you can significantly improve the security posture of your instances. ### **Rationale:** Restricting RDP access to specific IP addresses ensures that: - Only authorized users or services with known IP addresses can access the instance. - Exposure to brute-force attacks or unauthorized login attempts is minimized. - Compliance with security best practices for limiting remote access to only trusted sources. ### **Default Value:** By default, RDP access is often allowed from any IP address (0.0.0.0/0), which is not secure. This needs to be manually restricted to specific trusted IP addresses. **Impact:** - **Pros:** - Enhanced security by limiting RDP access to specific, trusted IP addresses. - Reduced attack surface for the instance, lowering the likelihood of unauthorized access. - Improved compliance with security policies requiring restricted access. - **Cons:** - If not properly configured, legitimate access may be blocked if the wrong IP address is restricted. - Requires ongoing management to ensure the correct IP addresses are added as needed. ### **Remediation:** **Test Plan:** **Using AWS Console:** 1. Log in to the AWS Console at [AWS Console](https://console.aws.amazon.com/). 2. Navigate to EC2 under Compute. 3. In the Security Groups section, select the security group associated with the Windows instance. 4. In the Inbound Rules tab, check the rule for RDP (TCP port 3389). 5. Edit the rule to restrict access to only trusted IP addresses or ranges by specifying a custom source IP (e.g., 203.0.113.0/24). 6. Save the changes and verify that only the specified IP addresses are allowed to access the instance via RDP. **Using AWS CLI:** 1. Run the following command to describe the security group associated with the Windows instance: aws ec2 describe-security-groups --group-ids 2. Review the current inbound rules and ensure that RDP access is allowed only from the specified IP addresses or ranges. 3. To modify the security group and restrict RDP access to a specific IP address, use the following command: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 3389 --cidr /32 4. To remove access from any other IP range, use the following command: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0 **Implementation Plan:** **Using AWS Console:** 1. Log in to the AWS Console at [AWS Console](https://console.aws.amazon.com/). 2. Go to EC2 and select Security Groups under Network & Security. 3. Find the security group attached to your Windows instance and select it. 4. Review the Inbound Rules and restrict the RDP access rule to specific IP addresses or IP ranges (e.g., 203.0.113.0/24). 5. Save the changes, and verify that only the trusted IP addresses have RDP access. **Using AWS CLI:** 1. To allow RDP access only from specific IP addresses, use the following command: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 3389 --cidr /32 2. To revoke access from any IP address (0.0.0.0/0), use the following command: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0 **Backout Plan:** **Using AWS Console:** 1. If legitimate access is blocked, log in to the AWS Console. 2. Navigate to EC2 and go to Security Groups. 3. Edit the inbound rule to re-allow access from the previous IP range or remove the IP restriction. **Using AWS CLI:** 1. If RDP access needs to be restored to its original state, run the following command: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr /32 2. Revert the rule to allow access from 0.0.0.0/0 if needed: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0 **References:** - [AWS CLI: describe-security-groups ](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html) - [AWS CLI: authorize-security-group-ingress ](https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html) - [AWS CLI: revoke-security-group-ingress ](https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html) - [AWS EC2 Documentation ](https://docs.aws.amazon.com/ec2/latest/UserGuide/) **CIS Controls:**

Version	Control ID	Control Description
v8	3.4	Ensure RDP access is restricted to only trusted IP addresses to reduce the attack surface and prevent unauthorized access.
v7	14.2	Implement network access controls to restrict RDP access to only authorized users and systems.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.