SecurityGroup RFC 1918

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under Network & Security, choose Security Groups.

04 Click inside the Filter security groups box located under the console top menu and select the following options from the Properties dropdown menu:

1. Choose Source/Destination (CIDR), type 10.0.0.0/8, and press Enter.
2. Choose again Source/Destination (CIDR), type 172.16.0.0/12, and press Enter.
3. Choose Source/Destination (CIDR), type 192.168.0.0/16, and press Enter.

05 Check the results returned by the Amazon EC2 console. If the console returns one or more Amazon EC2 security groups, there are security groups that allow traffic from RFC-1918 CIDRs, available within the current AWS cloud region.

06 Change the AWS region from the navigation bar and repeat the audit process for other regions.

01 Run describe-security-groups command (OSX/Linux/UNIX) with predefined and custom query filters to expose the Amazon EC2 security groups that allow inbound/ingress traffic from RFC-1918 CIDRs:

aws ec2 describe-security-groups
  --region us-east-1
  --filters Name=ip-permission.cidr,Values='10.0.0.0/8,172.16.0.0/12,192.168.0.0/16'
  --output table
  --query 'SecurityGroups[*].GroupId'

02 The command output should return a table with the requested security group ID(s):

--------------------------
| DescribeSecurityGroups |
+------------------------+
|  sg-01234abcd1234abcd  |
|  sg-0abcd1234abcd1234  |
+------------------------+

03 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 and 2 to perform the audit process for other regions.

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion":"2010-09-09",
	"Description":"Configure RFC-1918 security group to allow access to trusted entities only",
	"Resources":{
	"DBSecurityGroup" : {
			"Type" : "AWS::EC2::SecurityGroup",
			"Properties" : {
			"GroupDescription" : "Allow MySQL database access",
			"GroupName" : "db-instance-security-group",
			"VpcId" : "vpc-1234abcd",
			"SecurityGroupIngress" : [{
				"IpProtocol" : "tcp",
				"FromPort" : 3306,
				"ToPort" : 3306,
				"CidrIp" : "192.168.0.5/32"
			}],
			"SecurityGroupEgress" : [{
				"IpProtocol" : "-1",
				"FromPort" : 0,
				"ToPort" : 65535,
				"CidrIp" : "0.0.0.0/0"
			}]
			}
		}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Description: Configure RFC-1918 security group to allow access to trusted entities only
	Resources:
		DBSecurityGroup:
		Type: AWS::EC2::SecurityGroup
		Properties:
			GroupDescription: Allow MySQL database access
			GroupName: db-instance-security-group
			VpcId: vpc-1234abcd
			SecurityGroupIngress:
			- IpProtocol: tcp
			FromPort: 3306
			ToPort: 3306
			CidrIp: 192.168.0.5/32
			SecurityGroupEgress:
			- IpProtocol: "-1"
			FromPort: 0
			ToPort: 65535
			CidrIp: 0.0.0.0/0

01 Terraform configuration file (.tf):

terraform {
	required_providers {
		aws = {
			source  = "hashicorp/aws"
			version = "~> 3.27"
		}
	}

	required_version = ">= 0.14.9"
}

provider "aws" {
	profile = "default"
	region  = "us-east-1"
}

resource "aws_security_group" "db-security-group" {
	name        = "db-instance-security-group"
	description = "Allow MySQL database access"
	vpc_id      = "vpc-1234abcd"

	# Configure RFC-1918 security group to allow access to trusted entities only
	ingress {
		from_port        = 3306
		to_port          = 3306
		protocol         = "tcp"
		cidr_blocks      = ["192.168.0.5/32"]
	}

	egress {
		from_port        = 0
		to_port          = 0
		protocol         = "-1"
		cidr_blocks      = ["0.0.0.0/0"]
	}

}

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2.

03 In the navigation panel, under Network & Security, choose Security Groups.

04 Select the Amazon EC2 security group that you want to reconfigure.

05 Select the Inbound rules tab from the console bottom panel and choose Edit inbound rules.

06 On the Edit inbound rules configuration page, change the traffic source for the inbound rule that allows access from RFC-1918 CIDRs (regardless of the port used), by performing one of the following actions:

1. Select Custom from the Source dropdown list and enter one of the following options based on your access requirements:
   • A specific IPv4 address with the suffix set to /32 (e.g. 192.168.0.5/32), representing the private IP address of the trusted host that requires access to the Amazon EC2 instance(s) associated with the selected security group.
   • The name or ID of another security group available in the same AWS cloud region.
2. Choose Save rules to apply the configuration changes.

07 Repeat steps no. 4 – 6 to reconfigure other Amazon EC2 security groups that allow inbound traffic from RFC-1918 CIDRs.

08 Change the AWS cloud region from the console navigation bar and repeat the remediation process for other regions.

01 Run revoke-security-group-ingress command (OSX/Linux/UNIX) using the ID of the Amazon EC2 security group that you want to reconfigure as the identifier parameter, to remove the inbound rule(s) that contain(s) RFC-1918 CIDRs (i.e. 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) from the selected security group. The following command request example removes an inbound/ingress rule that allows access from the RFC-1918 CIDR 192.168.0.0/16:

aws ec2 revoke-security-group-ingress
  --region us-east-1
  --group-id sg-01234abcd1234abcd
  --protocol tcp
  --port 3306
  --cidr 192.168.0.0/16
  --query 'Return'

02 The command output should return true if the request succeeds. Otherwise, it should return an error:

true

03 Run authorize-security-group-ingress command (OSX/Linux/UNIX) to add the inbound rule removed at the previous step with a different set of parameters in order to restrict access to trusted entities only (IP addresses or security groups). To create and attach custom inbound/ingress rules to the selected Amazon EC2 security group based on your access requirements, use one of the following options (the command does not produce an output):

1. Add an inbound rule that allows traffic from an authorized private IPv4 address using CIDR notation (e.g. 192.168.0.5/32):
   aws ec2 authorize-security-group-ingress
     --region us-east-1
     --group-id sg-01234abcd1234abcd
     --protocol tcp
     --port 3306
     --cidr 192.168.0.5/32
   

2. Add an inbound rule that allows traffic from another security group (e.g. sg-01234123412341234) available in the same AWS cloud region:
   aws ec2 authorize-security-group-ingress
     --region us-east-1
     --group-id sg-01234abcd1234abcd
     --protocol tcp
     --port 3306
     --source-group sg-01234123412341234
   

04 Repeat steps no. 1 – 3 to reconfigure other EC2 security groups that allow inbound traffic from RFC-1918 CIDRs.

05 Change the AWS cloud region by updating the --region command parameter value and repeat the remediation process for other regions.