AWSRecreateSG

Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.

python · AWS Enrichment and Remediation

Details

ID	`AWSRecreateSG`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules and replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc.) being exposed to the internet via IPv4.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.5.0

Dependencies

This script uses the following commands and scripts.

aws-ec2-revoke-security-group-egress-rule
aws-ec2-authorize-security-group-ingress-rule
aws-ec2-authorize-security-group-egress-rule
aws-ec2-describe-instances
aws-ec2-revoke-security-group-ingress-rule
aws-ec2-create-security-group

Used In

This script is used in the following playbooks and scripts.

AWS - Security Group Remediation v2

Inputs

Argument Name	Description
instance_id	EC2 Instance ID.
port	TCP/UDP port to be restricted.
protocol	Protocol of the port to be restricted.
public_ip	Public IP address of the EC2 instance.
assume_role	Name of an AWS role to assume (should be the same for all organizations).
region	Region where EC2 instance is present.

Outputs

Path	Description	Type
awssgrecreated	Sets the value to true or false if the security group is created.	boolean

Source

AWSRecreateSG.py AWSRecreateSG_test.py AWSRecreateSG.yml

Download History Raw

args:
- description: EC2 Instance ID.
  name: instance_id
  required: true
- description: TCP/UDP port to be restricted.
  name: port
  required: true
- description: Protocol of the port to be restricted.
  auto: PREDEFINED
  name: protocol
  predefined:
  - tcp
  - udp
  required: true
- description: Public IP address of the EC2 instance.
  name: public_ip
  required: true
- description: Name of an AWS role to assume (should be the same for all organizations).
  name: assume_role
- description: Region where EC2 instance is present.
  name: region
  auto: PREDEFINED
  predefined:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - us-gov-east-1
  - us-gov-west-1
comment: Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed.  Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
commonfields:
  id: AWSRecreateSG
  version: -1
dependson:
  must:
  - AWS - EC2|||aws-ec2-describe-instances
  - AWS - EC2|||aws-ec2-create-security-group
  - AWS - EC2|||aws-ec2-authorize-security-group-ingress-rule
  - AWS - EC2|||aws-ec2-authorize-security-group-egress-rule
  - AWS - EC2|||aws-ec2-revoke-security-group-ingress-rule
  - AWS - EC2|||aws-ec2-revoke-security-group-egress-rule
dockerimage: demisto/python3:3.12.13.10116658
enabled: true
name: AWSRecreateSG
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags: []
type: python
fromversion: 6.5.0
tests:
- No tests (auto formatted)
engineinfo: {}
runonce: false
outputs:
- contextPath: awssgrecreated
  description: Sets the value to true or false if the security group is created.
  type: boolean