ySql1lvPAYue9jDX1mTdDetecting and Marking Non-Compliant VPC Security Groups: SOC2 Compliance
Detecting and Marking Non-Compliant VPC Security Groups: SOC2 Compliance
This task focuses on scrutinizing default security groups in AWS VPCs to identify and flag those allowing unauthorized traffic. It serves as a critical measure to pinpoint security groups that deviate from the no-traffic policy, ensuring adherence to stringent network security protocols in VPC environments.
inputs
outputs
import boto3
from botocore.exceptions import ClientError
creds = _get_creds(cred_label)['creds']
access_key = creds['username']
secret_key = creds['password']
def check_default_security_groups(region_name=None):
non_compliant_sgs = []
compliant_sgs = []
if region_name:
print(f"Checking default security groups in specified region: {region_name}")
regions_to_check = [region_name]
else:
print("Checking default security groups in all AWS regions...")
regions_to_check = [region['RegionName'] for region in boto3.client('ec2', aws_access_key_id=access_key,aws_secret_access_key=secret_key,region_name='us-east-1').describe_regions()['Regions']]
for region in regions_to_check:
try:
ec2_client = boto3.client('ec2', aws_access_key_id=access_key,aws_secret_access_key=secret_key,region_name=region)
vpcs = ec2_client.describe_vpcs()['Vpcs']
if not vpcs:
print(f"No VPCs found in region {region}.")
continue
for vpc in vpcs:
sg_response = ec2_client.describe_security_groups(
Filters=[{'Name': 'vpc-id', 'Values': [vpc['VpcId']]},
{'Name': 'group-name', 'Values': ['default']}]
)
for sg in sg_response['SecurityGroups']:
inbound_rules = sg['IpPermissions']
outbound_rules = sg['IpPermissionsEgress']
if inbound_rules or outbound_rules:
non_compliant_sgs.append({
'Region': region,
'VpcId': vpc['VpcId'],
'SecurityGroupId': sg['GroupId']
})
else:
compliant_sgs.append({
'Region': region,
'VpcId': vpc['VpcId'],
'SecurityGroupId': sg['GroupId']
})
except ClientError as e:
print(f"An AWS client error occurred in region {region}: {e}")
return non_compliant_sgs, compliant_sgs
# Example usage
#region_name = None # Use None for all regions, or specify a region like 'us-west-2'
non_compliant_security_groups, compliant_security_groups = check_default_security_groups(region_name)
if non_compliant_security_groups:
print("\nNon-compliant default security groups found:")
for sg_info in non_compliant_security_groups:
print(f"Region: {sg_info['Region']}, VPC ID: {sg_info['VpcId']}, Security Group ID: {sg_info['SecurityGroupId']} is NON_COMPLIANT")
if compliant_security_groups:
print("\nCompliant default security groups found:")
for sg_info in compliant_security_groups:
print(f"Region: {sg_info['Region']}, VPC ID: {sg_info['VpcId']}, Security Group ID: {sg_info['SecurityGroupId']} is COMPLIANT")
if not non_compliant_security_groups and not compliant_security_groups:
print("\nNo VPCs with default security groups were found.")
context.skip_sub_tasks=True
copied- 1Cn09UVVGIqVK8dHcQafjImplementing No-Traffic Policy in VPC Default Security Groups
1
This task involves configuring the default security groups within AWS VPCs to strictly enforce a no-traffic policy. It entails systematically updating the security group rules to block all inbound and outbound traffic, ensuring compliance with stringent network security protocols.
inputsoutputsimport boto3 from botocore.exceptions import ClientError, BotoCoreError, NoCredentialsError creds = _get_creds(cred_label)['creds'] access_key = creds['username'] secret_key = creds['password'] def remediate_default_sg_of_vpc(region_name, vpc_id): """ Removes all inbound and outbound rules from the default security group of a specified VPC. Parameters: region_name (str): AWS region of the VPC. vpc_id (str): ID of the VPC whose default security group needs to be remediated. Returns: None """ if not region_name or not vpc_id: print("Error: 'region_name' and 'vpc_id' must be provided.") return try: ec2_client = boto3.client('ec2', aws_access_key_id=access_key,aws_secret_access_key=secret_key,region_name=region_name) sg_response = ec2_client.describe_security_groups( Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}, {'Name': 'group-name', 'Values': ['default']}] ) #print(sg_response) # for debugging if sg_response['SecurityGroups']: sg_id = sg_response['SecurityGroups'][0]['GroupId'] #print(sg_id) # for debugging # Remove all inbound and outbound rules try: # Retrieve existing rules current_sg = ec2_client.describe_security_groups(GroupIds=[sg_id])['SecurityGroups'][0] inbound_rules = current_sg.get('IpPermissions', []) outbound_rules = current_sg.get('IpPermissionsEgress', []) # Remove inbound rules if inbound_rules: ec2_client.revoke_security_group_ingress(GroupId=sg_id, IpPermissions=inbound_rules) print(f"Removed all inbound rules from default security group {sg_id} in VPC {vpc_id}.") # Remove outbound rules if outbound_rules: ec2_client.revoke_security_group_egress(GroupId=sg_id, IpPermissions=outbound_rules) print(f"Removed all outbound rules from default security group {sg_id} in VPC {vpc_id}.") # Verification step updated_sg = ec2_client.describe_security_groups(GroupIds=[sg_id])['SecurityGroups'][0] if not updated_sg.get('IpPermissions') and not updated_sg.get('IpPermissionsEgress'): print(f"Successfully removed all rules from security group {sg_id}.") else: print(f"Rules may not have been completely removed from security group {sg_id}.") except ClientError as e: print(f"Error modifying security group {sg_id}: {e}") else: print(f"No default security group found for VPC {vpc_id}.") except NoCredentialsError: print("Error: No AWS credentials found. Please configure your credentials.") except BotoCoreError as e: print(f"BotoCore Error: {e}") except ClientError as e: print(f"Client Error: {e}") except Exception as e: print(f"An unexpected error occurred: {e}") # Example usage #region_name = 'us-west-2' # Specify the AWS region #vpc_id = 'vpc-0e42a95f21ed25d5c' # Replace with your VPC ID remediate_default_sg_of_vpc(region_name, vpc_id)copied1