Security Hub CSPM controls for Amazon EC2
These AWS Security Hub CSPM controls evaluate the Amazon Elastic Compute Cloud (Amazon EC2) service and resources. The controls might not be available in all AWS Regions. For more information, see Availability of controls by Region.
[EC2.1] Amazon EBS snapshots should not be configured to be publicly restorable
Related requirements: PCI DSS v3.2.1/1.2.1,PCI DSS v3.2.1/1.3.1,PCI DSS v3.2.1/1.3.4,PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)
Category: Protect > Secure network configuration
Severity: Critical
Resource type:
AWS::::Account
AWS Config rule:
ebs-snapshot-public-restorable-check
Schedule type: Periodic
Parameters: None
This control checks whether Amazon Elastic Block Store snapshots are configured to be publicly restorable. The control fails if Amazon EBS snapshots are configured to be restorable by all.
EBS snapshots are used to back up the data on your EBS volumes to Amazon S3 at a specific point in time. You can use the snapshots to restore previous states of EBS volumes. It is rarely acceptable to share a snapshot with the public. Typically the decision to share a snapshot publicly was made in error or without a complete understanding of the implications. This check helps ensure that all such sharing was fully planned and intentional.
Remediation
To make a public EBS snapshot private, see Share a snapshot in the Amazon EC2 User Guide. For Actions, Modify permissions, choose Private.
[EC2.2] VPC default security groups should not allow inbound or outbound traffic
Related requirements: CIS AWS Foundations Benchmark v5.0.0/5.5, PCI DSS v3.2.1/1.2.1,PCI DSS v3.2.1/1.3.4,PCI DSS v3.2.1/2.1, CIS AWS Foundations Benchmark v1.2.0/4.3, CIS AWS Foundations Benchmark v1.4.0/5.3, CIS AWS Foundations Benchmark v3.0.0/5.4, NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5)
Category: Protect > Secure network configuration
Severity: High
Resource type:
AWS::EC2::SecurityGroup
AWS Config rule:
vpc-default-security-group-closed
Schedule type: Change triggered
Parameters: None
This control checks whether the default security group of a VPC allows inbound or outbound traffic. The control fails if the security group allows inbound or outbound traffic.
The rules for the default security group allow all outbound and inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group. We recommend that you don't use the default security group. Because the default security group cannot be deleted, you should change the default security group rules setting to restrict inbound and outbound traffic. This prevents unintended traffic if the default security group is accidentally configured for resources such as EC2 instances.
Remediation
To remediate this issue, start by creating new least-privilege security groups. For instructions, see Create a security group in the Amazon VPC User Guide. Then, assign the new security groups to your EC2 instances. For instructions, see Change an instance's security group in the Amazon EC2 User Guide.
After you assign the new security groups to your resources, remove all inbound and outbound rules from the default security groups. For instructions, see Configure security group rules in the Amazon VPC User Guide.
[EC2.3] Attached Amazon EBS volumes should be encrypted at-rest
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6)
Category: Protect > Data Protection > Encryption of data-at-rest
Severity: Medium
Resource type:
AWS::EC2::Volume
AWS Config rule:
encrypted-volumes
Schedule type: Change triggered
Parameters: None
This control checks whether the EBS volumes that are in an attached state are encrypted. To pass this check, EBS volumes must be in use and encrypted. If the EBS volume is not attached, then it is not subject to this check.
For an added layer of security of your sensitive data in EBS volumes, you should enable EBS encryption at rest. Amazon EBS encryption offers a straightforward encryption solution for your EBS resources that doesn't require you to build, maintain, and secure your own key management infrastructure. It uses KMS keys when creating encrypted volumes and snapshots.
To learn more about Amazon EBS encryption, see Amazon EBS encryption in the Amazon EC2 User Guide.
Remediation
There's no direct way to encrypt an existing unencrypted volume or snapshot. You can only encrypt a new volume or snapshot when you create it.
If you enabled encryption by default, Amazon EBS encrypts the resulting new volume or snapshot using your default key for Amazon EBS encryption. Even if you have not enabled encryption by default, you can enable encryption when you create an individual volume or snapshot. In both cases, you can override the default key for Amazon EBS encryption and choose a symmetric customer managed key.
For more information, see Creating an Amazon EBS volume and Copying an Amazon EBS snapshot in the Amazon EC2 User Guide.
[EC2.4] Stopped EC2 instances should be removed after a specified time period
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2)
Category: Identify > Inventory
Severity: Medium
Resource type:
AWS::EC2::Instance
AWS Config rule:
ec2-stopped-instance-days-check (custom Security Hub CSPM rule)
Schedule type: Periodic
Parameters:
| Parameter | Description | Type | Allowed custom values | Security Hub CSPM default value |
|---|---|---|---|---|
|
|
Number of days the EC2 instance is allowed to be in a stopped state before generating a failed finding. |
Integer |
|
|
This control checks whether an Amazon EC2 instance has been stopped for longer than the allowed number of days. The control fails if an EC2 instance is stopped for longer than the maximum allowed time period. Unless you provide a custom parameter value for the maximum allowed time period, Security Hub CSPM uses a default value of 30 days.
When an EC2 instance has not run for a significant period of time, it creates a security risk because the instance is not being actively maintained (analyzed, patched, updated). If it is later launched, the lack of proper maintenance could result in unexpected issues in your AWS environment. To safely maintain an EC2 instance over time in an inactive state, start it periodically for maintenance and then stop it after maintenance. Ideally, this should be an automated process.
Note
This control evaluates the number of days that an EC2 instance has been stopped using the
timestamp from StateTransitionReason for the instance. When the
StateTransitionReason does not include a timestamp (such as when an instance
is stopped due to an internal error), the control uses the instance's launch time instead.
In this case, if the launch time is older than the maximum allowed time period,
the control generates a FAILED finding.
Remediation
To terminate an inactive EC2 instance, see Terminate an instance in the Amazon EC2 User Guide.
[EC2.6] VPC flow logging should be enabled in all VPCs
Related requirements: CIS AWS Foundations Benchmark v5.0.0/3.7, CIS AWS Foundations Benchmark v1.2.0/2.9, CIS AWS Foundations Benchmark v1.4.0/3.9, CIS AWS Foundations Benchmark v3.0.0/3.7, NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-7(8), NIST.800-171.r2 3.1.20, NIST.800-171.r2 3.3.1, NIST.800-171.r2 3.13.1, PCI DSS v3.2.1/10.3.3, PCI DSS v3.2.1/10.3.4, PCI DSS v3.2.1/10.3.5, PCI DSS v3.2.1/10.3.6
Category: Identify > Logging
Severity: Medium
Resource type:
AWS::EC2::VPC
AWS Config rule:
vpc-flow-logs-enabled
Schedule type: Periodic
Parameters:
-
trafficType:REJECT(not customizable)
This control checks whether Amazon VPC Flow Logs are found and enabled for VPCs. The
traffic type is set to Reject. The control fails if VPC Flow Logs aren't
enabled for VPCs in your account.
Note
This control doesn't check whether Amazon VPC Flow Logs are enabled through Amazon Security Lake for the AWS account.
With the VPC Flow Logs feature, you can capture information about the IP address traffic going to and from network interfaces in your VPC. After you create a flow log, you can view and retrieve its data in CloudWatch Logs. To reduce cost, you can also send your flow logs to Amazon S3.
Security Hub CSPM recommends that you enable flow logging for packet rejects for VPCs. Flow logs provide visibility into network traffic that traverses the VPC and can detect anomalous traffic or provide insight during security workflows.
By default, the record includes values for the different components of the IP address flow, including the source, destination, and protocol. For more information and descriptions of the log fields, see VPC Flow Logs in the Amazon VPC User Guide.
Remediation
To create a VPC Flow Log, see Create a Flow Log in the Amazon VPC User Guide. After you open the Amazon VPC console, choose Your VPCs. For Filter, choose Reject or All.
[EC2.7] EBS default encryption should be enabled
Related requirements: CIS AWS Foundations Benchmark v5.0.0/5.1.1, CIS AWS Foundations Benchmark v1.4.0/2.2.1, CIS AWS Foundations Benchmark v3.0.0/2.2.1, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6)
Category: Protect > Data Protection > Encryption of data-at-rest
Severity: Medium
Resource type:
AWS::::Account
AWS Config rule:
ec2-ebs-encryption-by-default
Schedule type: Periodic
Parameters: None
This control checks whether account-level encryption is enabled by default for Amazon Elastic Block Store (Amazon EBS) volumes. The control fails if the account level encryption isn't enabled for EBS volumes.
When encryption is enabled for your account, Amazon EBS volumes and snapshot copies are encrypted at rest. This adds an additional layer of protection for your data. For more information, see Encryption by default in the Amazon EC2 User Guide.
Remediation
To configure default encryption for Amazon EBS volumes, see Encryption by default in the Amazon EC2 User Guide.
[EC2.8] EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)
Related requirements: CIS AWS Foundations Benchmark v5.0.0/5.7, CIS AWS Foundations Benchmark v3.0.0/5.6, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6, PCI DSS v4.0.1/2.2.6
Category: Protect > Network Security
Severity: High
Resource type:
AWS::EC2::Instance
AWS Config rule:
ec2-imdsv2-check
Schedule type: Change triggered
Parameters: None
This control checks whether your EC2 instance metadata version is configured with
Instance Metadata Service Version 2 (IMDSv2). The control passes if
HttpTokens is set to required for IMDSv2. The control fails if
HttpTokens is set to optional.
You use instance metadata to configure or manage the running instance. The IMDS provides access to temporary, frequently rotated credentials. These credentials remove the need to hard code or distribute sensitive credentials to instances manually or programmatically. The IMDS is attached locally to every EC2 instance. It runs on a special "link local" IP address of 169.254.169.254. This IP address is only accessible by software that runs on the instance.
Version 2 of the IMDS adds new protections for the following types of vulnerabilities. These vulnerabilities could be used to try to access the IMDS.
-
Open website application firewalls
-
Open reverse proxies
-
Server-side request forgery (SSRF) vulnerabilities
-
Open Layer 3 firewalls and network address translation (NAT)
Security Hub CSPM recommends that you configure your EC2 instances with IMDSv2.
Remediation
To configure EC2 instances with IMDSv2, see Recommended path to requiring IMDSv2 in the Amazon EC2 User Guide.
[EC2.9] Amazon EC2 instances should not have a public IPv4 address
Related requirements: NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)
Category: Protect > Secure network configuration > Resources not publicly accessible
Severity: High
Resource type:
AWS::EC2::Instance
AWS Config rule:
ec2-instance-no-public-ip
Schedule type: Change triggered
Parameters: None
This control checks whether EC2 instances have a public IP address. The control fails
if the publicIp field is present in the EC2 instance configuration item.
This control applies to IPv4 addresses only.
A public IPv4 address is an IP address that is reachable from the internet. If you launch your instance with a public IP address, then your EC2 instance is reachable from the internet. A private IPv4 address is an IP address that is not reachable from the internet. You can use private IPv4 addresses for communication between EC2 instances in the same VPC or in your connected private network.
IPv6 addresses are globally unique, and therefore are reachable from the internet. However, by default all subnets have the IPv6 addressing attribute set to false. For more information about IPv6, see IP addressing in your VPC in the Amazon VPC User Guide.
If you have a legitimate use case to maintain EC2 instances with public IP addresses,
then you can suppress the findings from this control. For more information about
front-end architecture options, see the AWS
Architecture Blog
Remediation
Use a non-default VPC so that your instance isn't assigned a public IP address by default.
When you launch an EC2 instance into a default VPC, it is assigned a public IP address. When you launch an EC2 instance into a non-default VPC, the subnet configuration determines whether it receives a public IP address. The subnet has an attribute to determine if new EC2 instances in the subnet receive a public IP address from the public IPv4 address pool.
You can disassociate an automatically-assigned public IP address from your EC2 instance. For more information, see Public IPv4 addresses and external DNS hostnames in the Amazon EC2 User Guide.
[EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
Related requirements: NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-171.r2 3.1.3, NIST.800-171.r2 3.13.1
Category: Protect > Secure network configuration > API private access
Severity: Medium
Resource type:
AWS::EC2::VPC
AWS Config rule: vpc-endpoint-enabled
Schedule type: Periodic
Parameters:
-
serviceNames:ec2(not customizable)
This control checks whether a service endpoint for Amazon EC2 is created for each VPC. The control fails if a VPC does not have a VPC endpoint created for the Amazon EC2 service.
This control evaluates resources in single account. It cannot describe resources that
are outside of the account. Because AWS Config and Security Hub CSPM do not conduct cross-account checks,
you will see FAILED findings for VPCs that are shared across accounts.
Security Hub CSPM recommends that you suppress these FAILED findings.
To improve the security posture of your VPC, you can configure Amazon EC2 to use an interface VPC endpoint. Interface endpoints are powered by AWS PrivateLink, a technology that enables you to access Amazon EC2 API operations privately. It restricts all network traffic between your VPC and Amazon EC2 to the Amazon network. Because endpoints are supported within the same Region only, you cannot create an endpoint between a VPC and a service in a different Region. This prevents unintended Amazon EC2 API calls to other Regions.
To learn more about creating VPC endpoints for Amazon EC2, see Amazon EC2 and interface VPC endpoints in the Amazon EC2 User Guide.
Remediation
To create an interface endpoint to Amazon EC2 from the Amazon VPC console, see Create a VPC endpoint in the AWS PrivateLink Guide. For Service name,
choose
com.amazonaws.region.ec2.
You can also create and attach an endpoint policy to your VPC endpoint to control access to the Amazon EC2 API. For instructions on creating a VPC endpoint policy, see Create an endpoint policy in the Amazon EC2 User Guide.
[EC2.12] Unused Amazon EC2 EIPs should be removed
Related requirements: PCI DSS v3.2.1/2.4, NIST.800-53.r5 CM-8(1)
Category: Protect > Secure network configuration
Severity: Low
Resource type:
AWS::EC2::EIP
AWS Config rule:
eip-attached
Schedule type: Change triggered
Parameters: None
This control checks whether Elastic IP (EIP) addresses that are allocated to a VPC are attached to EC2 instances or in-use elastic network interfaces (ENIs).
A failed finding indicates you may have unused EC2 EIPs.
This will help you maintain an accurate asset inventory of EIPs in your cardholder data environment (CDE).
Remediation
To release an unused EIP, see Release an Elastic IP address in the Amazon EC2 User Guide.
[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22
Related requirements: CIS AWS Foundations Benchmark v1.2.0/4.1, NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CM-7, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5), NIST.800-171.r2 3.1.3, NIST.800-171.r2 3.13.1, PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/2.2.2, PCI DSS v4.0.1/1.3.1
Category: Protect > Secure network configuration
Severity: High
Resource type:
AWS::EC2::SecurityGroup
AWS Config rule:
restricted-ssh
Schedule type: Change triggered and periodic
Parameters: None
This control checks whether an Amazon EC2 security group allows ingress from 0.0.0.0/0 or ::/0 to port 22. The control fails if the security group allows ingress from 0.0.0.0/0 or ::/0 to port 22.
Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. We recommend that no security group allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.
Remediation
To prohibit ingress to port 22, remove the rule that allows such access for each security group associated with a VPC. For instructions, see Update security group rules in the Amazon EC2 User Guide. After selecting a security group in the Amazon EC2 console, choose Actions, Edit inbound rules. Remove the rule that allows access to port 22.
[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389
Related requirements: CIS AWS Foundations Benchmark v1.2.0/4.2, PCI DSS v4.0.1/1.3.1
Category: Protect > Secure network configuration
Severity: High
Resource type:
AWS::EC2::SecurityGroup
AWS Config rule:
restricted-common-ports (created rule is
restricted-rdp)
Schedule type: Change triggered and periodic
Parameters: None
This control checks whether an Amazon EC2 security group allows ingress from 0.0.0.0/0 or ::/0 to port 3389. The control fails if the security group allows ingress from 0.0.0.0/0 or ::/0 to port 3389.
Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. We recommend that no security group allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Remediation
To prohibit ingress to port 3389, remove the rule that allows such access for each security group associated with a VPC. For instructions, see Update security group rules in the Amazon VPC User Guide. After selecting a security group in the Amazon VPC Console, choose Actions, Edit inbound rules. Remove the rule that allows access to port 3389.
[EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses
Related requirements: NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9), PCI DSS v4.0.1/1.4.4
Category: Protect > Network Security
Severity: Medium
Resource type:
AWS::EC2::Subnet
AWS Config rule:
subnet-auto-assign-public-ip-disabled
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon Virtual Private Cloud (Amazon VPC) subnet is configured to automatically assign public IP addresses. The control fails if the subnet is configured to automatically assign public IPv4 or IPv6 addresses.
Subnets have attributes that determine whether network interfaces automatically
receive public IPv4 and IPv6 addresses. For IPv4, this attribute is set to
TRUE for default subnets and FALSE for nondefault subnets
(with an exception for nondefault subnets created through the EC2 launch instance
wizard, where it's set to TRUE). For IPv6, this attribute is set to
FALSE for all subnets by default. When these attributes are enabled,
instances launched in the subnet automatically receive the corresponding IP addresses
(IPv4 or IPv6) on their primary network interface.
Remediation
To configure a subnet to not assign public IP addresses, see Modify the IP addressing attributes of your subnet in the Amazon VPC User Guide.
[EC2.16] Unused Network Access Control Lists should be removed
Related requirements: NIST.800-53.r5 CM-8(1), NIST.800-171.r2 3.4.7, PCI DSS v4.0.1/1.2.7
Category: Protect > Network Security
Severity: Low
Resource type:
AWS::EC2::NetworkAcl
AWS Config rule:
vpc-network-acl-unused-check