Policy Packs

guardrails-samples

This section contains recommendations for configuring security-related aspects of AWS Virtual Private Cloud (VPC).

AWS CIS v3.0.0 - Section 5 - Networking

main

aws_ec2_account_attributes_instance_metadata_service_defaults

Instance metadata is data about your instance that you can use to configure or manage the running instance.&#92;nInstance metadata is divided into categories, for example, host name, events, and security groups.&#92;n&#92;nInstance metadata can be accessed from a running instance using one of the following methods:&#92;n&#92;n  * Instance Metadata Service Version 1 (IMDSv1) – a request/response method&#92;n&#92;n  * Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method&#92;n&#92;nBy default, you can use either IMDSv1 or IMDSv2, or both. However, the instance metadata service can be specifically&#92;nconfigured to use IMDSv2 on each instance. When you specify that IMDSv2 must be used, IMDSv1 no longer works.&#92;n

ec2AccountAttributesInstanceMetadataServiceDefaults

AWS > EC2 > Account Attributes > Instance Metadata Service Defaults

aws_vpc_network_acl_ingress_rules_approved

Configure Network ACL Rules checking. This control defines whether to&#92;nverify the network ACL ingress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the network ACL.&#92;n

networkAclIngressRulesApproved

AWS > VPC > Network ACL > Ingress Rules > Approved

aws_vpc_network_acl_ingress_rules_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject network ACL rules.&#92;n&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`. The rules are processed in order,&#92;nand any built-in Turbot rules will appear first in the list of compiled&#92;nrules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  # Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  # Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n&#92;n  # Reject any rule using specific protocols like TCP(6), UDP(17) and All(-1)&#92;n  REJECT $.IpProtocol:tcp,udp,-1&#92;n  ```&#92;n

networkAclIngressRulesApprovedRules

AWS > VPC > Network ACL > Ingress Rules > Approved > Rules

aws_vpc_security_group_egress_rules_approved

Configure Security Group Egress Rule checking. This policy defines whether&#92;nto verify the security group egress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the security group.&#92;n

securityGroupEgressRulesApproved

AWS > VPC > Security Group > Egress Rules > Approved

aws_vpc_security_group_egress_rules_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject security group rules.&#92;n&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`. The rules are processed in order,&#92;nand any built-in Turbot rules will appear first in the list of compiled&#92;nrules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  Allow all rules from security groups in this account&#92;n  APPROVE $.UserIdGroupPairs.+.UserId:&quot;969297701313&quot;&#92;n&#92;n  Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n  ```&#92;n

securityGroupEgressRulesApprovedRules

AWS > VPC > Security Group > Egress Rules > Approved > Rules

aws_vpc_security_group_ingress_rules_approved

Configure Security Group Ingress Rule checking. This policy defines whether&#92;nto verify the security group ingress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the security group.&#92;n

Policy	Setting	Note
AWS > EC2 > Account Attributes > Instance Metadata Service Defaults	Check: Enabled for V2 only	AWS CIS v3.0.0 - Controls: 5.6
AWS > VPC > Network ACL > Ingress Rules > Approved	Check: Approved	AWS CIS v3.0.0 - Controls: 5.1
AWS > VPC > Network ACL > Ingress Rules > Approved > Rules	# Reject port range sizes -1 (all traffic) REJECT \ $.turbot.portRangeSize:-1 \ $.turbot.cidr:0.0.0.0/0 # Reject prohibited ports REJECT \ $.turbot.ports.+:22,3389 \ $.IpProtocol:tcp,udp \ $.turbot.cidr:0.0.0.0/0 # Approve any unmatched rules APPROVE *	AWS CIS v3.0.0 - Controls: 5.1
AWS > VPC > Security Group > Egress Rules > Approved	Check: Approved	AWS CIS v3.0.0 - Controls: 5.4
AWS > VPC > Security Group > Egress Rules > Approved > Rules	Calculated	AWS CIS v3.0.0 - Controls: 5.4
AWS > VPC > Security Group > Ingress Rules > Approved	Check: Approved	AWS CIS v3.0.0 - Controls: 5.2, 5.3, 5.4
AWS > VPC > Security Group > Ingress Rules > Approved > Rules	Calculated	AWS CIS v3.0.0 - Controls: 5.2, 5.3, 5.4

Policy Settings