Sensitive port is exposed to wide private network

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-sensitive-port-is-exposed-to-wide-private-network

Provider: AWS

Platform: Terraform

Severity: Low

Category: Networking and Firewall

Learn More

Description

Leaving sensitive ports such as port 23 (Telnet) or port 110 (POP3) open to a wide private network via insecure security group rules can expose resources to unnecessary risk, as these ports are frequently targeted by attackers seeking to exploit legacy or weakly protected protocols. In Terraform, a misconfiguration, as in the example below, makes internal resources within the VPC accessible to all hosts in the private address range, greatly increasing the attack surface if any host in that range is compromised. :

ingress {
  from_port   = 23
  to_port     = 23
  protocol    = "tcp"
  cidr_blocks = ["10.0.0.0/8"]
}

Restricting access to only necessary subnets and ports significantly reduces the risk of lateral movement and unauthorized access within your network:

ingress {
  from_port   = 2383
  to_port     = 2383
  protocol    = "tcp"
  cidr_blocks = [aws_vpc.main.cidr_block]
}

Compliant Code Examples

# The rule's own documented "safe" example is scoping ingress to the
# enclosing VPC's own CIDR (cidr_blocks = [aws_vpc.main.cidr_block]), as
# opposed to an arbitrary wide private range. aws_vpc.cidr_block is a
# direct user input (not provider-computed), so it's fully known at plan
# time even for a fresh-create VPC - a real terraform plan resolves it
# to the literal CIDR, indistinguishable by value alone from a hardcoded
# wide-private-range literal. See test/negative1.json, and
# ingress_cidr_is_own_vpc() in query.rego, which resolves this
# correctly by comparing the security group's own vpc_id and ingress
# configuration-expression references (both still present alongside the
# resolved value) to confirm the CIDR traces back to the security
# group's own VPC.
resource "aws_security_group" "negative1" {
  name        = "allow_tls1"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "TLS from VPC"
    from_port   = 2383
    to_port     = 2383
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.main.cidr_block]
  }
}

resource "aws_security_group" "negative2" {
  name        = "allow_tls2"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "TLS from VPC"
    from_port   = 2384
    to_port     = 2386
    protocol    = "tcp"
    cidr_blocks = ["/0"]
  }
}

resource "aws_security_group" "negative3" {
  name        = "allow_tls3"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "TLS from VPC"
    from_port   = 25
    to_port     = 2500
    protocol    = "tcp"
    cidr_blocks = ["1.2.3.4/0"]
  }
}

Non-Compliant Code Examples

resource "aws_security_group" "positive1" {
  name        = "allow_tls1"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "TLS from VPC"
    from_port   = 2200
    to_port     = 2500
    protocol    = "-1"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

# Same wide-private-CIDR-via-reference shape as test/negative1.tf, but
# the CIDR in ingress references an UNRELATED VPC (other), not the
# security group's own VPC (main) named in vpc_id. This must still be
# flagged: ingress_cidr_is_own_vpc() in query.rego only excludes a CIDR
# that traces back to the security group's own vpc_id target.
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_vpc" "other" {
  cidr_block = "10.1.0.0/16"
}

resource "aws_security_group" "positive11" {
  name        = "allow_tls11"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "TLS from an unrelated VPC"
    from_port   = 2383
    to_port     = 2383
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.other.cidr_block]
  }
}

# A security group with TWO ingress blocks: one scoped to its own VPC's
# CIDR (safe, same as test/negative1.tf), one scoped to an UNRELATED
# VPC's CIDR (unsafe, same as test/positive11.tf). Only the unrelated
# block must be flagged - cidr_matches_own_vpc() in query.rego checks
# per-ingress-block, not per-security-group, precisely so the own-VPC
# block can't suppress the finding for the unrelated one.
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_vpc" "other" {
  cidr_block = "10.1.0.0/16"
}

resource "aws_security_group" "positive12" {
  name        = "allow_tls12"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "TLS from own VPC"
    from_port   = 2383
    to_port     = 2383
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.main.cidr_block]
  }

  ingress {
    description = "TLS from an unrelated VPC"
    from_port   = 2383
    to_port     = 2383
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.other.cidr_block]
  }
}