IDENTIFY INTERNET FACING ADMINISTRATIVE USERS

Find any instances or TCP ELBs with port 22 (ssh) or 3389 (RDP) open.

Summary:

One of the most common security exposures are instances in security groups with ports 22 or 3389 open to the Interent (0.0.0.0/0). These are typically administrative servers and jump boxes. This Op identifies any security groups with the administrative ports open, and then determine if there are any exposed instances within those security groups. It can’t differentiate between instances that are Internet accessible, in ones that are still protected because they are in a private subnet.

DisruptOps users can choose to lock down the security group to pre-approved IP addresses, or completely quarantine the instances.