Find any instances or TCP ELBs with port 22 or RDP open.
One of the most common security exposures are instances in security groups with ports 22 or 3389 open to the Interent (0.0.0.0/0). These are typically administrative servers and jump boxes. This Op identifies any security groups with the administrative ports open, and then determine if there are any exposed instances within those security groups. It can’t differentiate between instances that are Internet accessible, in ones that are still protected because they are in a private subnet.
DisruptOps users can choose to lock down the security group to pre-approved IP addresses, or completely quarantine the instances.
Supported Issue Types:
Instance exposed to Internet
- The instance has Port 22 or 3389 open to 0.0.0.0/0
Instance at risk but not exposed
- The instance has Port 22 or 3389 open to 0.0.0.0/0 but is not in a publicly accessible subnet
- Restrict to approved IP address
- Revoke security group ingress rules
In Quick and Dirty: Building an S3 guardrail with Config we highlighted one of the big problems with Config: you need to set it up in each region of each account. Your best bet to make [...]
In How S3 Buckets Become Public, and the Fastest Way to Find Yours we reviewed the myriad of ways S3 buckets become public and where to look for them. Today I'll show the easiest way [...]