Issue
What is the best way to close public Ports in AWS?
In Azure, we can use Deny's policy to restrict user to expose ports to the Internet.
Can I do the similar for the AWS Security group?
Solution
What is the best way to close public Ports in AWS?
To complement Chris' answer, you could setup an automation based on AWS Config. If you enable it, you can define a number of rules that can monitor your SGs. The rules can be custom or AWS managed. In fact AWS provides two managed rules that could be useful to you:
The rules would continuously or periodically scan for SG changes and monitor their ports. If any SG is found non-complaint you could remediate the issue automatically using SSM Automation or AWS Lambda function.
You could also restrict permissions to modify SG to your users using IAM policy. One specific is:
- ec2:AuthorizeSecurityGroupIngress: Grants permission to add one or more inbound rules to a security group
But the issue is that you can't limit it to specific ports. So either your users have permissions to set ingress rules, or they don't.
Answered By - Marcin Answer Checked By - Terry (WPSolving Volunteer)
