AwsEC2GetPublicSGRules

Find Security Group rules which allows ::/0 (IPv4) or 0.0.0.0/0.

python · AWS - EC2

Details

IDAwsEC2GetPublicSGRules
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
TagsAmazon Web Services

README

Find Security Group rules which allows ::/0 (IPv4) or 0.0.0.0/0.

Script Data

Name Description
Script Type python3
Tags Amazon Web Services
Cortex XSOAR Version 5.0.0

Used In

This script is used in the following playbooks and scripts.

  • Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port

Inputs

Argument Name Description
groupId Security Group ID (sg-xxxxxxxxx)
ipPermissions JSON string of the ipPermissions. IpPermissions should have one or more rules which are composed of IpProtocol, FromPort, ToPort, or IpRanges. Refer to aws-ec2-describe-security-groups (https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html) for example/reference.
protocol Protocol to check. TCP/UDP/All(-1)
fromPort Lower bound port range to be checked. If fromPort and toPort are not specified, all ports will be included.
toPort Upper bound port range to be checked. If fromPort and toPort are not specified, all ports will be included.
region Security group region
includeIPv6 Include IPv6 in the result. By default, IPv6 is not included

Outputs

Path Description Type
AWS.EC2.SecurityGroup.PublicRules List public Security Group rules Unknown
AWS.EC2.SecurityGroup.PublicRules.groupId Security Group ID String
AWS.EC2.SecurityGroup.PublicRules.ipProtocol IP Protocol (TCP/UDP/-1) String
AWS.EC2.SecurityGroup.PublicRules.fromPort Security Group rule’s lower bound port range Number
AWS.EC2.SecurityGroup.PublicRules.toPort Security Group rule’s upper bound port range Number
AWS.EC2.SecurityGroup.PublicRules.cidrIp Security Group rule’s CIDR range String
AWS.EC2.SecurityGroup.PublicRules.region Region of the security group String

Source

AwsEC2GetPublicSGRules.py AwsEC2GetPublicSGRules_test.py AwsEC2GetPublicSGRules.yml
Download History Raw 
from AwsEC2GetPublicSGRules import get_ec2_sg_public_rules

IPPERM = [
    {"IpProtocol": "-1", "IpRanges": [], "Ipv6Ranges": [{"CidrIpv6": "::/0"}], "PrefixListIds": [], "UserIdGroupPairs": []},
    {
        "FromPort": 10,
        "IpProtocol": "tcp",
        "IpRanges": [{"CidrIp": "0.0.0.0/0"}],
        "Ipv6Ranges": [{"CidrIpv6": "::/0"}],
        "PrefixListIds": [],
        "ToPort": 22,
        "UserIdGroupPairs": [],
    },
    {
        "FromPort": 22,
        "IpProtocol": "tcp",
        "IpRanges": [{"CidrIp": "0.0.0.0/0"}],
        "Ipv6Ranges": [{"CidrIpv6": "::/0"}],
        "PrefixListIds": [],
        "ToPort": 23,
        "UserIdGroupPairs": [],
    },
    {
        "FromPort": 55,
        "IpProtocol": "tcp",
        "IpRanges": [],
        "Ipv6Ranges": [{"CidrIpv6": "::/0"}],
        "PrefixListIds": [],
        "ToPort": 55,
        "UserIdGroupPairs": [],
    },
]

IPPERM2 = {
    "FromPort": 22,
    "IpProtocol": "tcp",
    "IpRanges": [{"CidrIp": "0.0.0.0/0"}],
    "Ipv6Ranges": [],
    "PrefixListIds": [],
    "ToPort": 22,
    "UserIdGroupPairs": [],
}


def test_get_ec2_sg_public_rules():
    expected1 = [
        {"groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "fromPort": 10, "toPort": 22, "cidrIp": "0.0.0.0/0"},
        {"groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "fromPort": 22, "toPort": 23, "cidrIp": "0.0.0.0/0"},
    ]

    expected2 = [
        {"cidrIp": "::/0", "groupId": "sg-12345", "ipProtocol": "-1", "region": "us-east-1"},
        {"cidrIp": "0.0.0.0/0", "fromPort": 10, "groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "toPort": 22},
        {"cidrIp": "::/0", "fromPort": 10, "groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "toPort": 22},
        {"cidrIp": "0.0.0.0/0", "fromPort": 22, "groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "toPort": 23},
        {"cidrIp": "::/0", "fromPort": 22, "groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "toPort": 23},
    ]

    expected3 = []

    expected4 = [{"cidrIp": "::/0", "groupId": "sg-12345", "ipProtocol": "-1", "region": "us-east-1"}]

    expected5 = [
        {"groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "fromPort": 22, "toPort": 22, "cidrIp": "0.0.0.0/0"}
    ]

    result1 = get_ec2_sg_public_rules(
        group_id="sg-12345",
        ip_permissions=IPPERM,
        checked_protocol="tcp",
        checked_from_port=22,
        checked_to_port=22,
        region="us-east-1",
        include_ipv6="no",
    )

    result2 = get_ec2_sg_public_rules(
        group_id="sg-12345",
        ip_permissions=IPPERM,
        checked_protocol="tcp",
        checked_from_port=22,
        checked_to_port=22,
        region="us-east-1",
        include_ipv6="yes",
    )

    result3 = get_ec2_sg_public_rules(
        group_id="sg-12345",
        ip_permissions=IPPERM,
        checked_protocol="udp",
        checked_from_port=55,
        checked_to_port=60,
        region="us-east-1",
        include_ipv6="no",
    )

    result4 = get_ec2_sg_public_rules(
        group_id="sg-12345",
        ip_permissions=IPPERM,
        checked_protocol="udp",
        checked_from_port=55,
        checked_to_port=60,
        region="us-east-1",
        include_ipv6="yes",
    )

    result5 = get_ec2_sg_public_rules(
        group_id="sg-12345",
        ip_permissions=IPPERM2,
        checked_protocol="tcp",
        checked_from_port=22,
        checked_to_port=22,
        region="us-east-1",
        include_ipv6="yes",
    )

    assert expected1 == result1
    assert expected2 == result2
    assert expected3 == result3
    assert expected4 == result4
    assert expected5 == result5