AWS Tower - Rule to detect all port

aws_tower_allow_all_from_public.json

{
  "message": {
    "text": "[{name}] Allow connection to all port from public network ({source}=>{ports})",
    "args": {
      "name": {
        "type": "variable",
        "variable": "sg_name"
      },
      "source": {
        "type": "variable",
        "variable": "source"
      },
      "ports": {
        "type": "variable",
        "variable": "ports"
      }
    }
  },
  "rules": [
    {
      "type": "in",
      "description": "Check if variable_in is in value_in",
      "conditions": [
        {
          "type": "constant",
          "name": "data_element",
          "value": "all"
        }
      ],
      "data_sources": [
        {
          "type": "variable",
          "name": "data_list",
          "value": "ports"
        }
      ]
    },
    {
      "type": "is_private_cidr",
      "description": "Check if source is not a private CIDR block - RFC 1918",
      "conditions": [
        {
          "type": "constant",
          "name": "is_private_cidr",
          "value": false
        }
      ],
      "data_sources": [
        {
          "type": "variable",
          "name": "source",
          "value": "source"
        }
      ]
    }
  ],
  "severity": "high"
}