Policy Packs

guardrails-samples

Ensure default security groups are not left open, as they could inadvertently permit unrestricted inbound and outbound traffic, leading to unauthorized access and exploitation of resources within the VPC.

Enforce AWS VPC Default Security Groups Deny All Traffic

main

aws_vpc_security_group_egress_rules_approved

Configure Security Group Egress Rule checking. This policy defines whether&#92;nto verify the security group egress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the security group.&#92;n

securityGroupEgressRulesApproved

AWS > VPC > Security Group > Egress Rules > Approved

aws_vpc_security_group_egress_rules_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject security group rules.&#92;n&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`. The rules are processed in order,&#92;nand any built-in Turbot rules will appear first in the list of compiled&#92;nrules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  Allow all rules from security groups in this account&#92;n  APPROVE $.UserIdGroupPairs.+.UserId:&quot;969297701313&quot;&#92;n&#92;n  Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n  ```&#92;n

securityGroupEgressRulesApprovedRules

AWS > VPC > Security Group > Egress Rules > Approved > Rules

aws_vpc_security_group_ingress_rules_approved

Configure Security Group Ingress Rule checking. This policy defines whether&#92;nto verify the security group ingress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the security group.&#92;n

securityGroupIngressRulesApproved

AWS > VPC > Security Group > Ingress Rules > Approved

aws_vpc_security_group_ingress_rules_approved_rules

securityGroupIngressRulesApprovedRules

AWS > VPC > Security Group > Ingress Rules > Approved > Rules

turbot_policy_setting.aws_vpc_security_group_egress_rules_approved

turbot_policy_setting.aws_vpc_security_group_egress_rules_approved_rules

turbot_policy_setting.aws_vpc_security_group_ingress_rules_approved

turbot_policy_setting.aws_vpc_security_group_ingress_rules_approved_rules

Policy	Setting	Note
AWS > VPC > Security Group > Egress Rules > Approved	Check: Approved
AWS > VPC > Security Group > Egress Rules > Approved > Rules	Calculated
AWS > VPC > Security Group > Ingress Rules > Approved	Check: Approved
AWS > VPC > Security Group > Ingress Rules > Approved > Rules	Calculated

Policy Settings