Description

Ensure that the default security group of every VPC has no inbound and no outbound rules, including the default self-referencing inbound rule, so that it allows no traffic at all. Resources launched without a specific security group are placed in the default security group, so keeping it empty prevents accidental traffic. Only default security groups of VPCs in use that are attached to at least one network interface are evaluated.

Rationale

The default security group allows all traffic between its members and all outbound traffic. Any instance or other resource that falls back to it can therefore communicate widely, which makes lateral movement, port scanning and data exfiltration easier, and unrestricted outbound access can be used for command-and-control traffic. Removing all rules from the default security group, and using dedicated security groups with explicit sources, destinations and ports for each workload, enforces least privilege and reduces the impact of a compromise.

Impact

  • Prevents resources from getting broad network access just because no security group was chosen

  • Encourages the use of dedicated, least-privilege security groups for each workload

  • Resources that currently use the default security group will lose all network connectivity until they are moved to a dedicated security group

Default Value

Every VPC has a default security group that cannot be deleted. By default it has an inbound rule that allows all traffic from members of the same security group and an outbound rule that allows all outbound IPv4 traffic.

Pre-Requisites

  • IAM permissions: ec2:DescribeSecurityGroups, ec2:DescribeNetworkInterfaces, ec2:RevokeSecurityGroupIngress, ec2:RevokeSecurityGroupEgress and ec2:ModifyNetworkInterfaceAttribute

  • A list of the resources that currently use the default security group, and dedicated security groups with the rules they need

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console and select Security groups.

  3. Select the security group named default for a VPC.

  4. Check the Inbound rules and Outbound rules tabs.

  5. Repeat for each VPC in each region in use.

  6. If the default security group is attached to a resource and has any inbound or outbound rule, follow the implementation steps.

CLI:

List the default security groups with their number of inbound and outbound rules:

aws ec2 describe-security-groups --region <REGION> --filters Name=group-name,Values=default --query "SecurityGroups[].[GroupId,VpcId,length(IpPermissions),length(IpPermissionsEgress)]" --output table

List the network interfaces that use a default security group:

aws ec2 describe-network-interfaces --region <REGION> --filters Name=group-id,Values=<SECURITY_GROUP_ID> --query "NetworkInterfaces[].[NetworkInterfaceId,InterfaceType,Description]" --output table

A default security group in a VPC that is in use and attached to at least one network interface fails if it has at least one inbound or outbound rule, including the default self-referencing inbound rule. Default security groups with no attached network interface are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Move the resources that use the default security group to dedicated security groups with the rules they need.

  3. Open the Amazon VPC console and select Security groups.

  4. Select the security group named default for the affected VPC.

  5. On the Inbound rules tab, choose Edit inbound rules, delete all rules and choose Save rules.

  6. On the Outbound rules tab, choose Edit outbound rules, delete all rules and choose Save rules.

  7. Repeat for each affected VPC in each region in use.

Backout Plan

Before making changes, save the current rules of the default security group:

aws ec2 describe-security-groups --region <REGION> --group-ids <SECURITY_GROUP_ID> > <SECURITY_GROUP_ID>-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console, select Security groups and select the default security group.

  3. On the Inbound rules and Outbound rules tabs, re-add the removed rules using the saved backup (type, protocol, port range and source or destination).

  4. Choose Save rules.

Note: rolling back gives resources in the default security group broad network access again. Use it only as a temporary measure.

Reference