255 lines
6.2 KiB
Plaintext
255 lines
6.2 KiB
Plaintext
== Why is this an issue?
|
|
|
|
include::../rationale.adoc[]
|
|
|
|
include::../impact.adoc[]
|
|
|
|
== How to fix it
|
|
|
|
include::../common/how-to-fix-it/intro.adoc[]
|
|
|
|
=== Code examples
|
|
|
|
==== Noncompliant code example
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/Instance.html[aws_cdk.aws_ec2.Instance] and other constructs that support a `connections` attribute:
|
|
|
|
[source,python,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
|
|
instance = ec2.Instance(
|
|
self,
|
|
"my_instance",
|
|
instance_type=nano_t2,
|
|
machine_image=ec2.MachineImage.latest_amazon_linux(),
|
|
vpc=vpc
|
|
)
|
|
|
|
instance.connections.allow_from(
|
|
ec2.Peer.any_ipv4(), # Noncompliant
|
|
ec2.Port.tcp(22),
|
|
description="Allows SSH from all IPv4"
|
|
)
|
|
instance.connections.allow_from_any_ipv4( # Noncompliant
|
|
ec2.Port.tcp(3389),
|
|
description="Allows Terminal Server from all IPv4"
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/SecurityGroup.html[aws_cdk.aws_ec2.SecurityGroup]
|
|
|
|
[source,python,diff-id=2,diff-type=noncompliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
security_group = ec2.SecurityGroup(
|
|
self,
|
|
"custom-security-group",
|
|
vpc=vpc
|
|
)
|
|
|
|
security_group.add_ingress_rule(
|
|
ec2.Peer.any_ipv4(), # Noncompliant
|
|
ec2.Port.tcp_range(1, 1024)
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/CfnSecurityGroup.html[aws_cdk.aws_ec2.CfnSecurityGroup]
|
|
|
|
[source,python,diff-id=3,diff-type=noncompliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
|
|
ec2.CfnSecurityGroup(
|
|
self,
|
|
"cfn-based-security-group",
|
|
group_description="cfn based security group",
|
|
group_name="cfn-based-security-group",
|
|
vpc_id=vpc.vpc_id,
|
|
security_group_ingress=[
|
|
ec2.CfnSecurityGroup.IngressProperty( # Noncompliant
|
|
ip_protocol="6",
|
|
cidr_ip="0.0.0.0/0",
|
|
from_port=22,
|
|
to_port=22
|
|
),
|
|
ec2.CfnSecurityGroup.IngressProperty( # Noncompliant
|
|
ip_protocol="tcp",
|
|
cidr_ip="0.0.0.0/0",
|
|
from_port=3389,
|
|
to_port=3389
|
|
),
|
|
{ # Noncompliant
|
|
"ipProtocol":"-1",
|
|
"cidrIpv6":"::/0"
|
|
}
|
|
]
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/CfnSecurityGroupIngress.html[aws_cdk.aws_ec2.CfnSecurityGroupIngress]
|
|
|
|
[source,python,diff-id=4,diff-type=noncompliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
|
|
ec2.CfnSecurityGroupIngress( # Noncompliant
|
|
self,
|
|
"ingress-all-ip-tcp-ssh",
|
|
ip_protocol="tcp",
|
|
cidr_ip="0.0.0.0/0",
|
|
from_port=22,
|
|
to_port=22,
|
|
group_id=security_group.attr_group_id
|
|
)
|
|
|
|
ec2.CfnSecurityGroupIngress( # Noncompliant
|
|
self,
|
|
"ingress-all-ipv6-all-tcp",
|
|
ip_protocol="-1",
|
|
cidr_ipv6="::/0",
|
|
group_id=security_group.attr_group_id
|
|
)
|
|
----
|
|
|
|
|
|
==== Compliant solution
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/Instance.html[aws_cdk.aws_ec2.Instance] and other constructs that support a `connections` attribute:
|
|
|
|
[source,python,diff-id=1,diff-type=compliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
|
|
instance = ec2.Instance(
|
|
self,
|
|
"my_instance",
|
|
instance_type=nano_t2,
|
|
machine_image=ec2.MachineImage.latest_amazon_linux(),
|
|
vpc=vpc
|
|
)
|
|
|
|
instance.connections.allow_from_any_ipv4(
|
|
ec2.Port.tcp(1234),
|
|
description="Allows 1234 from all IPv4"
|
|
)
|
|
|
|
instance.connections.allow_from(
|
|
ec2.Peer.ipv4("192.0.2.0/24"),
|
|
ec2.Port.tcp(22),
|
|
description="Allows SSH from all IPv4"
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/SecurityGroup.html[aws_cdk.aws_ec2.SecurityGroup]
|
|
|
|
[source,python,diff-id=2,diff-type=compliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
security_group = ec2.SecurityGroup(
|
|
self,
|
|
"custom-security-group",
|
|
vpc=vpc
|
|
)
|
|
|
|
security_group.add_ingress_rule(
|
|
ec2.Peer.any_ipv4(),
|
|
ec2.Port.tcp_range(1024, 1048)
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/CfnSecurityGroup.html[aws_cdk.aws_ec2.CfnSecurityGroup]
|
|
|
|
[source,python,diff-id=3,diff-type=compliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
|
|
ec2.CfnSecurityGroup(
|
|
self,
|
|
"cfn-based-security-group",
|
|
group_description="cfn based security group",
|
|
group_name="cfn-based-security-group",
|
|
vpc_id=vpc.vpc_id,
|
|
security_group_ingress=[
|
|
ec2.CfnSecurityGroup.IngressProperty(
|
|
ip_protocol="tcp",
|
|
cidr_ip="0.0.0.0/0",
|
|
from_port=1024,
|
|
to_port=1048
|
|
),
|
|
{
|
|
"ipProtocol":"6",
|
|
"cidrIp":"192.0.2.0/24",
|
|
"fromPort":22,
|
|
"toPort":22
|
|
}
|
|
]
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/CfnSecurityGroupIngress.html[aws_cdk.aws_ec2.CfnSecurityGroupIngress]
|
|
|
|
[source,python,diff-id=4,diff-type=compliant]
|
|
----
|
|
from aws_cdk import aws_ec2 as ec2
|
|
|
|
ec2.CfnSecurityGroupIngress(
|
|
self,
|
|
"ingress-all-ipv4-tcp-http",
|
|
ip_protocol="6",
|
|
cidr_ip="0.0.0.0/0",
|
|
from_port=80,
|
|
to_port=80,
|
|
group_id=security_group.attr_group_id
|
|
)
|
|
|
|
ec2.CfnSecurityGroupIngress(
|
|
self,
|
|
"ingress-range-tcp-rdp",
|
|
ip_protocol="tcp",
|
|
cidr_ip="192.0.2.0/24",
|
|
from_port=3389,
|
|
to_port=3389,
|
|
group_id=security_group.attr_group_id
|
|
)
|
|
----
|
|
|
|
|
|
== Resources
|
|
|
|
include::../common/resources/docs.adoc[]
|
|
|
|
include::../common/resources/articles.adoc[]
|
|
|
|
include::../common/resources/presentations.adoc[]
|
|
|
|
include::../common/resources/standards.adoc[]
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
== Message
|
|
When a call to `allow_from_any_ipv4` or `allow_default_port_from_any_ipv4` is identified:
|
|
* Change this method for `allow_from` and set `other` to a subset of trusted IP addresses
|
|
|
|
In any other case, when a dangerous peer definition is identified:
|
|
* Change this IP range to a subset of trusted IP addresses.
|
|
|
|
|
|
== Highlighting
|
|
|
|
When a call to `allow_from_any_ipv4` or `allow_default_port_from_any_ipv4` is identified:
|
|
* Highlight the method name
|
|
|
|
In any other case, when a dangerous peer definition is identified:
|
|
* Highlight the peer definition attribute, e.g. `cidr_ip` for `IngressProperty` constructors, `peer` parameter for `add_ingress_rule` calls, `other` for `allow_from` calls, etc.
|
|
|
|
|
|
'''
|
|
|
|
endif::env-github,rspecator-view[]
|