AWSRemediateSG

args:
- description: The AWS account ID.
  name: account_id
  required: true
- description: The EC2 resource ID to remediate security groups for.
  name: resource_id
  required: true
- description: A comma-separated list of security group IDs to recreate.
  name: sg_list
  required: true
  isArray: true
- description: TCP/UDP port to be restricted.
  name: port
  required: true
- description: The protocol of the port to be restricted.
  auto: PREDEFINED
  name: protocol
  predefined:
  - tcp
  - udp
  required: true
- description: The region where the EC2 instance resides.
  name: region
  auto: PREDEFINED
  required: true
  predefined:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - af-south-1
  - ap-east-1
  - ap-south-2
  - ap-southeast-3
  - ap-southeast-5
  - ap-southeast-4
  - ap-south-1
  - ap-northeast-3
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-southeast-7
  - ap-northeast-1
  - ca-central-1
  - ca-west-1
  - eu-central-1
  - eu-west-1
  - eu-west-2
  - eu-south-1
  - eu-west-3
  - eu-south-2
  - eu-north-1
  - eu-central-2
  - il-central-1
  - mx-central-1
  - me-south-1
  - me-central-1
  - sa-east-1
- description: The source addresses or CIDR ranges to allow to maintain internal access to the port to be restricted. Format entries as individual IPv4/IPv6 addresses or CIDR ranges, separated by a comma (,).
  name: remediation_allow_ranges
- description: The tags to apply to the recreated security groups. Use the format `key=abc,value=123;key=fed,value=456`, with tags separated by a semicolon (;).
  name: tags
- description: The AWS integration instance to use.
  name: integration_instance
comment: Duplicates security groups and modifies rules to remove public exposure for the specified port. The updated security groups can then be used to remediate public exposure of an AWS resource by replacing the existing list.
commonfields:
  id: AWSRemediateSG
  version: -1
dependson:
  must:
  - AWS|||aws-ec2-security-groups-describe
  - AWS|||aws-ec2-security-group-create
  - AWS|||aws-ec2-security-group-ingress-authorize
  - AWS|||aws-ec2-security-group-egress-authorize
  - AWS|||aws-ec2-security-group-egress-revoke
  - AWS|||aws-ec2-tags-create
dockerimage: demisto/python3:3.12.13.10116658
enabled: true
name: AWSRemediateSG
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags: []
type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)
engineinfo: {}
runonce: false
outputs:
- contextPath: AWSPublicExposure.SGReplacements.ReplacementSet.new-sg
  description: 'ID of the newly created security group with restricted permissions.'
  type: String
- contextPath: AWSPublicExposure.SGReplacements.ReplacementSet.old-sg
  description: 'ID of the original security group before remediation.'
  type: String
- contextPath: AWSPublicExposure.SGReplacements.ResourceID
  description: 'The EC2 resource ID to remediate security groups for.'
  type: String
- contextPath: AWSPublicExposure.SGReplacements.UpdatedSGList
  description: 'List of Security Groups to associate to the EC2 resource after remediation.'
  type: String
- contextPath: AWSPublicExposure.SGReplacements.RemediationRequired
  description: Indicates whether any of the provided security groups contained rules requiring remediation.
  type: Boolean