Unrestricted Redis Cache Access

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console available at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, under Network & Security, choose Security Groups.

04 Click inside the Find security groups by attribute or tag box located under Security Groups, type 6379 and press Enter, then select the following filter from the Client filters category: Protocol = TCP. This will return only the security groups that allow traffic on TCP port 6379.

05 Select the security group that you want to examine and choose the Inbound rules tab from the console split panel to access the inbound rules created for the selected group.

06 Check the configuration value available in the Source column for any inbound rules with the Port range set to 6379. If one or more ingress rules have the Source value set to 0.0.0.0/0 or ::/0 (i.e., Anywhere), the selected Amazon EC2 security group allows unrestricted traffic on TCP port 6379, therefore, the Redis Cache access to the associated EC2 instance(s) is not secured.

07 Repeat steps no. 5 and 6 for each Amazon EC2 security group returned as result in step no. 4.

08 Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

01 Run describe-security-groups command (OSX/Linux/UNIX) with predefined and custom query filters to expose the ID of each Amazon EC2 security group that allows unrestricted inbound access on TCP port 6379 (Redis):

aws ec2 describe-security-groups
	--region us-east-1
	--filters Name=ip-permission.from-port,Values=6379 Name=ip-permission.to-port,Values=6379 Name=ip-permission.cidr,Values='0.0.0.0/0','::/0'
	--output table
	--query 'SecurityGroups[*].GroupId'

02 The command output should return a table with the requested security group ID(s):

--------------------------
| DescribeSecurityGroups |
+------------------------+
|  sg-01234abcd1234abcd  |
|  sg-0abcd1234abcd1234  |
+------------------------+

03 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 and 2 to perform the Audit process for other regions.

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "Configure security group to restrict inbound Redis cache access to trusted servers only",
	"Resources": {
		"EC2SecurityGroup": {
			"Type": "AWS::EC2::SecurityGroup",
			"Properties": {
				"GroupName": "cc-instance-security-group",
				"GroupDescription": "Allow Redis access",
				"VpcId": "vpc-01234abcd1234abcd",
				"SecurityGroupIngress": [
					{
						"Description": "Allow inbound Redis traffic",
						"IpProtocol": "tcp",
						"FromPort": 6379,
						"ToPort": 6379,
						"CidrIp": "0.0.0.0/0"
						"SourceSecurityGroupId": "sg-0abcdabcdabcdabcd"
					}
				],
				"SecurityGroupEgress": [
					{
						"Description": "Allow all outbound traffic",
						"IpProtocol": "-1",
						"FromPort": 0,
						"ToPort": 65535,
						"CidrIp": "0.0.0.0/0"
					}
				]
			}
		}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Description: Configure security group to restrict inbound Redis cache access to trusted servers only
	Resources:
	EC2SecurityGroup:
		Type: AWS::EC2::SecurityGroup
		Properties:
		GroupName: cc-instance-security-group
		GroupDescription: Allow Redis access
		VpcId: vpc-01234abcd1234abcd
		SecurityGroupIngress:
			- Description: Allow inbound Redis traffic
			IpProtocol: tcp
			FromPort: 6379
			ToPort: 6379
			CidrIp: '0.0.0.0/0'
			SourceSecurityGroupId: sg-0abcdabcdabcdabcd
		SecurityGroupEgress:
			- Description: Allow all outbound traffic
			IpProtocol: '-1'
			FromPort: 0
			ToPort: 65535
			CidrIp: '0.0.0.0/0'

01 Terraform configuration file (.tf):

terraform {
	required_providers {
		aws = {
			source  = "hashicorp/aws"
			version = "~> 4.0"
		}
	}
	required_version = ">= 0.14.9"
}
provider "aws" {
	profile = "default"
	region  = "us-east-1"
}
resource "aws_security_group" "ec2-security-group" {
	name        = "cc-instance-security-group"
	description = "Allow Redis access"
	vpc_id      = "vpc-01234abcd1234abcd"
	ingress {
		description      = "Allow inbound Redis traffic"
		from_port        = 6379
		to_port          = 6379
		protocol         = "tcp"
		cidr_blocks      = ["0.0.0.0/0"]
		security_groups  = ["sg-0abcdabcdabcdabcd"]
	}
	egress {
		description      = "Allow all outbound traffic"
		from_port        = 0
		to_port          = 0
		protocol         = "-1"
		cidr_blocks      = ["0.0.0.0/0"]
	}
}

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console available at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, under Network & Security, choose Security Groups.

04 Click inside the Find security groups by attribute or tag box located under Security Groups, type 6379 and press Enter, then select the following filter from the Client filters category: Protocol = TCP. This will return only the security groups that allow traffic on TCP port 6379.

05 Select the Amazon EC2 security group that you want to configure.

06 Select the Inbound rules tab from the console split panel and choose Edit inbound rules.

07 On the Edit inbound rules configuration page, change the traffic source for the inbound rule that allows unrestricted access on TCP port 6379, by performing one of the following actions:

1. Select My IP from the Source dropdown list to allow inbound traffic only from your current IP address.
2. Select Custom from the Source dropdown list and enter one of the following sources based on your access requirements:
   1. The static IP address of the permitted host in CIDR notation (e.g., 10.0.0.5/32).
   2. The IP address range of the permitted network/subnetwork in CIDR notation, for example, 10.0.5.0/24.
   3. The name or ID of another security group available in the Security Groups section.
   4. The name or ID of a prefix list available in the Prefix lists section. Prefix lists simplify security group configuration by grouping frequently used CIDR blocks.
3. Choose Save rules to apply the configuration changes.

08 Repeat steps no. 5 – 7 for each Amazon EC2 security group that allows unrestricted Redis Cache access.

09 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

01 Run revoke-security-group-ingress command (OSX/Linux/UNIX) with the ID of the Amazon EC2 security group that you want to configure as the identifier parameter, to remove the inbound rules that allow unrestricted access on TCP port 6379 (Redis Cache):

aws ec2 revoke-security-group-ingress
	--region us-east-1
	--group-id sg-01234abcd1234abcd
	--ip-permissions IpProtocol=tcp,FromPort=6379,ToPort=6379,IpRanges=[{CidrIp="0.0.0.0/0"}],Ipv6Ranges=[{CidrIpv6="::/0"}]
	--query 'Return'

02 The command output should return true if the command request succeeds:

true

03 Run authorize-security-group-ingress command (OSX/Linux/UNIX) to add the inbound rule removed in the previous step with a different set of parameters in order to restrict access on TCP port 6379 to trusted entities only (IP addresses, IP address ranges, security groups, or prefix lists). To create and attach custom inbound (ingress) rules to the selected Amazon EC2 security group based on your access requirements, use one of the following options (the command output should return true if the command request succeeds):

1. Add an inbound rule that allows traffic from an authorized static IP address via TCP port 6379, using CIDR notation (e.g., 10.0.0.5/32):
   aws ec2 authorize-security-group-ingress
   	--region us-east-1
   	--group-id sg-01234abcd1234abcd
   	--protocol tcp
   	--port 6379
   	--cidr 10.0.0.5/32
   	--query 'Return'
   

2. Add an ingress rule that allows traffic from a trusted IP address range via TCP port 6379, using CIDR notation (for example, 10.0.5.0/24):
   aws ec2 authorize-security-group-ingress
   	--region us-east-1
   	--group-id sg-01234abcd1234abcd
   	--protocol tcp
   	--port 6379
   	--cidr 10.0.5.0/24
   	--query 'Return'
   

3. Add an inbound rule that allows traffic from another security group (e.g., sg-01234123412341234) available in the same AWS cloud region via TCP port 6379:
   aws ec2 authorize-security-group-ingress
   	--region us-east-1
   	--group-id sg-01234abcd1234abcd
   	--protocol tcp
   	--port 6379
   	--source-group sg-01234123412341234
   	--query 'Return'
   

4. Add an ingress rule that allows traffic from an AWS prefix list (e.g., pl-0123abcd) via TCP port 6379:
   aws ec2 authorize-security-group-ingress
   	--region us-east-1
   	--group-id sg-01234abcd1234abcd
   	--ip-permissions 'IpProtocol=tcp,FromPort=6379,ToPort=6379,PrefixListIds=[{PrefixListId=pl-0123abcd}]'
   	--query 'Return'
   

04 Repeat steps no. 1 – 3 for each Amazon EC2 security group that allows unrestricted Redis Cache access.

05 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 4 to perform the Remediation process for other regions.