Find any instances or TCP ELBs with port 22 or RDP open.
One of the most common security exposures are instances in security groups with ports 22 or 3389 open to the Interent (0.0.0.0/0). These are typically administrative servers and jump boxes. This Op identifies any security groups with the administrative ports open, and then determine if there are any exposed instances within those security groups. It can’t differentiate between instances that are Internet accessible, in ones that are still protected because they are in a private subnet.
DisruptOps users can choose to lock down the security group to pre-approved IP addresses, or completely quarantine the instances.
Supported Issue Types:
Instance exposed to Internet
- The instance has Port 22 or 3389 open to 0.0.0.0/0
Instance at risk but not exposed
- The instance has Port 22 or 3389 open to 0.0.0.0/0 but is not in a publicly accessible subnet
- Restrict to approved IP address
- Revoke security group ingress rules
We spend a lot of time talking to cloud security professionals, basically trying to figure out the best ways to get their jobs done in largely uncharted territory. Cloud technology is evolving at an unprecedented [...]
In Quick and Dirty: Building an S3 guardrail with Config we highlighted one of the big problems with Config: you need to set it up in each region of each account. Your best bet to make [...]