RDP access is not restricted

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: terraform-gcp-rdp-access-is-not-restricted

Provider: GCP

Platform: Terraform

Severity: High

Category: Networking and Firewall

Learn More

Description

This check verifies if Google Compute firewall rules allow unrestricted RDP access by examining if port 3389 (the default RDP port) is openly accessible from the internet. When firewall rules allow RDP traffic from 0.0.0.0/0 (all IPv4) or ::/0 (all IPv6), it significantly increases the risk of brute force attacks, unauthorized access, and potential system compromise.

Vulnerable configurations include allowing port 3389 directly or within ranges (for example, 21-3390), or using protocol = "all" with unrestricted source ranges. To secure your environment, explicitly exclude RDP ports from public access and restrict RDP traffic to specific trusted IP addresses or VPN connections.

// Insecure configuration (AVOID):
resource "google_compute_firewall" "insecure" {
  // ... other configuration ...
  allow {
    protocol = "tcp"
    ports    = ["80", "3389"]
  }
  source_ranges = ["0.0.0.0/0"]
}

// Secure configuration:
resource "google_compute_firewall" "secure" {
  // ... other configuration ...
  allow {
    protocol = "tcp"
    ports    = ["80", "8080", "1000-2000"] // Excludes RDP port 3389
  }
  source_tags = ["web"]
  // Alternatively, limit RDP to specific IPs:
  // source_ranges = ["10.0.0.0/24", "192.168.1.0/24"]
}

Compliant Code Examples

resource "google_compute_firewall" "negative1" {
  name    = "test-firewall"
  network = google_compute_network.default.name

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
    ports    = ["80", "8080", "1000-2000"]
  }

  source_tags = ["web"]
}

Non-Compliant Code Examples

resource "google_compute_firewall" "positive1" {
  name    = "test-firewall"
  network = google_compute_network.default.name
  direction = "INGRESS"

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
    ports    = ["80", "8080", "1000-2000","3389"]
  }

  source_tags = ["web"]
  source_ranges = ["0.0.0.0/0"]
}

resource "google_compute_firewall" "positive2" {
  name    = "test-firewall"
  network = google_compute_network.default.name

  allow {
    protocol = "udp"
    ports    = ["80", "8080", "1000-2000","21-3390"]
  }

  source_tags = ["web"]
  source_ranges = ["::/0"]
}

resource "google_compute_firewall" "positive3" {
  name    = "test-firewall"
  network = google_compute_network.default.name

  allow {
    protocol = "all"
  }

  source_tags = ["web"]
  source_ranges = ["::/0"]
}