Description

Ensure that no Amazon EC2 security group allows inbound TCP traffic from the Internet (0.0.0.0/0 or ::/0) to the SSH port 22. Access to this port should be limited to trusted networks or specific security groups. Security groups that have all ports open to the Internet are reported by the separate check for all ports and pass this check, so they are not reported twice.

Rationale

SSH provides remote shell access to instances. If port 22 is open to the Internet, automated scanners continuously attempt brute-force and credential stuffing attacks. A successful login gives an attacker a remote shell that can be used to steal data, change configuration, run crypto-mining or move laterally. Restricting SSH to trusted sources, or using AWS Systems Manager Session Manager or a bastion host, applies least privilege at the network layer and reduces the attack surface.

Impact

  • Prevents direct Internet access to SSH on your instances

  • Reduces the risk of brute-force logins, remote shell access and lateral movement

  • Administrators currently connecting over the Internet will lose access until their source addresses are added as trusted CIDRs, or they connect through Session Manager, a VPN or a bastion host

Default Value

A newly created security group has no inbound rules, so all inbound traffic is denied by default. Unrestricted access to port 22 exists only if a rule was explicitly added. When the EC2 launch instance wizard creates a new security group, it proposes an SSH rule from Anywhere (0.0.0.0/0) unless the source is changed.

Pre-Requisites

  • IAM permissions: ec2:DescribeSecurityGroups, ec2:DescribeSecurityGroupRules, ec2:RevokeSecurityGroupIngress and ec2:AuthorizeSecurityGroupIngress

  • A list of the trusted CIDR ranges or security groups that legitimately need access to SSH

  • Confirmation from the application owner that no required client depends on Internet access to this port

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Security Groups under Network & Security.

  3. Select a security group and open the Inbound rules tab.

  4. Check for any rule whose source is 0.0.0.0/0 or ::/0 and that either:

    • has type All traffic, or

    • uses protocol TCP with a port or port range that includes 22.

  5. Repeat for each security group in each region in use.

  6. If such a rule exists, follow the implementation steps.

CLI:

List the security groups that have any rule open to the Internet:

aws ec2 describe-security-groups --region <REGION> --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query "SecurityGroups[].GroupId"
aws ec2 describe-security-groups --region <REGION> --filters Name=ip-permission.ipv6-cidr,Values=::/0 --query "SecurityGroups[].GroupId"

For each group returned, list its public inbound rules:

aws ec2 describe-security-group-rules --region <REGION> --filters Name=group-id,Values=<SECURITY_GROUP_ID> --query "SecurityGroupRules[?IsEgress==\`false\` && (CidrIpv4=='0.0.0.0/0' || CidrIpv6=='::/0')].[SecurityGroupRuleId,IpProtocol,FromPort,ToPort,CidrIpv4,CidrIpv6]" --output table

The group fails if any row has protocol tcp with a FromPort–ToPort range that includes 22 but is narrower than 0-65535. Rows with protocol -1 (all traffic) or the full range 0-65535 mean all ports are open; such groups are reported by the separate check for all ports and pass this check. A security group that has all ports open to the Internet passes this check, because it is reported by the separate check for all ports.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Security Groups under Network & Security.

  3. Select the security group found in the Test Plan and open the Inbound rules tab.

  4. Choose Edit inbound rules and delete any rule whose source is 0.0.0.0/0 or ::/0 and that either:

    • has type All traffic, or

    • uses protocol TCP with a port or port range that includes 22.

  5. If access to SSH is still needed, choose Add rule, select type Custom TCP, enter the required port and set the source to a trusted IP range or security group.

  6. Choose Save rules.

  7. Repeat for each affected security group in each region in use.

CLI:

Remove the public rule for the SSH port. The provided command removes only the IPv4 rule; this version removes both the IPv4 and IPv6 rules:

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]'

If the rule is a port range or All traffic, remove it using the rule ID from the Test Plan output:

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --security-group-rule-ids <SECURITY_GROUP_RULE_ID>

If access is still needed, allow the port from a trusted IP range only:

aws ec2 authorize-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges='[{CidrIp=<TRUSTED_CIDR>,Description="SSH access from trusted network"}]'

Backout Plan

Before making changes, save the current inbound rules:

aws ec2 describe-security-group-rules --filters Name=group-id,Values=<SECURITY_GROUP_ID> > <SECURITY_GROUP_ID>-rules-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Go to EC2 > Security Groups and select the security group.

  3. In Inbound rules, choose Edit inbound rules.

  4. Re-add the removed rules using the saved backup (protocol, port range and source).

  5. Choose Save rules.

Note: rolling back re-exposes the SSH port to the Internet. Use it only as a temporary measure while access through trusted sources is arranged.

Reference