Outbound access on all ports should be restricted

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

Reduce the probability of a breach by checking EC2 security groups for outbound rules that allow unfettered access to any TCP/UDP ports and restrict access to IP addresses that require this port.

Rationale

Malicious activity, such as denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, can occur when permitting unfettered outbound access.

Remediation

From the console

Follow the Security group rules docs to learn how to add a security group rule that will restrict access to IP addresses that require a specific port.

From the command line

  1. Run revoke-security-group-egress to remove IP permissions for the selected EC2 security group.

    revoke-security-group-egress.sh

        aws ec2 revoke-security-group-egress
            --group-id your-group-id
            --ip-permissions '[{"IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]'
        
  2. Run authorize-security-group-egress with new parameters to restrict outbound access to specific destinations.

    authorize-security-group-egress.sh

        aws ec2 authorize-security-group-egress
            --group-id your-group-id
            --ip-permissions '[{"IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]'