Mods
AWS

Policy: AWS > CIS v1.4 > 5 - Networking > 5.03 - Ensure the default security group of every VPC restricts all traffic (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation.

Resource Types

This policy targets the following resource types:

Primary Policy

This policy is used with the following primary policy:

Controls

Policy Specification

Schema Type
string
Default
Per AWS > CIS v1.4 > 5 - Networking
Valid Values [YAML]
  • Per AWS > CIS v1.4 > 5 - Networking
    
  • Skip
    
  • Check: Level 2 (Scored)
    

Category

In Your Workspace

Developers