Skip to content

Instantly share code, notes, and snippets.

@jtroberts83
Created April 10, 2018 21:22
Show Gist options
  • Save jtroberts83/12b2bb11af9228eda5d16575d48bab81 to your computer and use it in GitHub Desktop.
Save jtroberts83/12b2bb11af9228eda5d16575d48bab81 to your computer and use it in GitHub Desktop.
Fixed file for user
policies:
- name: high-risk-security-groups-remediate3
resource: security-group
description: |
Remove any rule from a security group that allows test ingress
and notify the user who added the violating rule.
mode:
type: cloudtrail
events:
- source: ec2.amazonaws.com
event: AuthorizeSecurityGroupIngress
ids: "requestParameters.groupId"
- source: ec2.amazonaws.com
event: AuthorizeSecurityGroupEgress
ids: "requestParameters.groupId"
- source: ec2.amazonaws.com
event: RevokeSecurityGroupEgress
ids: "requestParameters.groupId"
- source: ec2.amazonaws.com
event: RevokeSecurityGroupIngress
ids: "requestParameters.groupId"
filters:
- or:
- type: ingress
Ports: [8999,9000,9500]
Cidr:
value_type: cidr
op: in
value: 1.2.3.4
- type: ingress
Ports: [5123]
Cidr:
value_type: cidr
op: in
value: 3.4.5.6
actions:
- type: remove-permissions
ingress: matched
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment