| Plugin Title | Default Security Group |
| Cloud | AWS |
| Category | EC2 |
| Description | Ensure the default security groups block all traffic by default |
| More Info | The default security group is often used for resources launched without a defined security group. For this reason, the default rules should be to block all traffic to prevent an accidental exposure. |
| AWS Link | http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#default-security-group |
| Recommended Action | Update the rules for the default security group to deny all traffic by default |
- Log into the AWS Management Console.
- Select the "Services" option and search for EC2.
- Scroll down the left navigation panel and choose "Instances".
- Select the "Instance" that needs to be verified and click on its name from the "Name" column.
- Scroll down the page and under "Description" check for "Security Groups". If the "Security Groups" is set to "default" then the EC2 network configuration is not following AWS security best practices.
- Repeat steps number 2 - 5 to verify other "EC2 Instances".
- Scroll down the left navigation panel and choose "Security Groups" under "Network & Security".
- Click on the "Create Security Group" to create a new group as per our "EC2 Instance" requirements.
- Provide a name to the "Security Group" and select the "Inbound" and "Outbound" traffic rules as per the requirements.
- Click on the "Create" button at the bottom of the "Create Security Group" tab to create the new security group.
- Scroll the left navigation panel and choose "Instances".
- Select the "EC2 Instance" whose "Security Group" needs to be updated.
- Click on the "Actions" button at the top and click on the "Networking" and choose the "Change Security Group" option.
- Select the new "Security Group" created and click on the "Assign Security Groups" button to attach the selected "Security Group" to the selected "EC2 Instance".
- Repeat steps number 8 - 14 to update the "Security Group" as per the requirements.
