<  Back to rules search

Inbound DNS access is restricted

ec2
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Reduce the possibility of a breach by checking EC2 security groups for inbound rules that allow unfettered access to TCP and UDP port 53, commonly used during DNS resolution when a request is sent from DNS clients to DNS servers or between DNS servers.

Rationale

Malicious activity, such as distributed denial-of-service (DDoS) attacks, can occur when permitting unfettered DNS access.

Remediation

Console

Follow the Security group rules docs to learn how to add a security group rule that will restrict access to a specific port.

CLI

  1. Run describe-security-groups with a filter to expose security groups that allow access to port 53.

    describe-security-groups.sh

        aws ec2 revoke-security-group-egress
            --group-id your-group-id
            --ip-permissions '[{"IpProtocol": "tcp", "FromPort": 53, "ToPort": 53, "IpRanges": [{"CidrIp": "192.0.2.0/24"}]}]'