prowler 5.16.0__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018.metadata.json

@@ -1,31 +1,35 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018",
-  "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018.",
-  "CheckAliases": [
-    "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018"
-  ],
+  "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MongoDB TCP ports 27017 and 27018",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "TTPs/Initial Access",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** are inspected for inbound rules that expose **MongoDB** on `TCP 27017-27018` to the Internet via `0.0.0.0/0` or `::/0`.\n\nIt identifies groups where these ports are reachable from any address.",
+  "Risk": "Public **MongoDB** ports invite unauthenticated probing, brute force, and misuse of weak configs. Attackers can read/alter data, drop collections, or deploy ransomware, compromising **confidentiality** and **integrity**.\n\nExposure also enables enumeration and lateral movement, threatening **availability**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
+    "https://support.icompaas.com/support/solutions/articles/62000127019-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-mongodb-ports-27017-and-27018"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":27017,\"ToPort\":27018,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
+      "NativeIaC": "```yaml\n# CloudFormation: restrict MongoDB ports from Internet\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Restrict MongoDB ports\n      VpcId: <example_resource_id>\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 27017\n          ToPort: 27018\n          CidrIp: 10.0.0.0/8  # FIX: not 0.0.0.0/0 or ::/0; limits access to internal range\n```",
+      "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to your resource\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find rules for TCP ports 27017 or 27018 with Source 0.0.0.0/0 or ::/0\n5. Delete those rules or change Source to a specific trusted CIDR (e.g., 10.0.0.0/8)\n6. Click Save rules",
+      "Terraform": "```hcl\n# Restrict MongoDB ports from Internet\nresource \"aws_security_group\" \"secure\" {\n  name   = \"<example_resource_name>\"\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 27017\n    to_port     = 27018\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"] # FIX: not 0.0.0.0/0 or ::/0; restricts Internet access\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Apply **least privilege** to MongoDB access:\n- Block `0.0.0.0/0` and `::/0`\n- Allow only trusted IPs or private networks\n- Prefer private connectivity and SG-to-SG references\n- Enforce authentication and TLS\n- Segment east-west traffic and monitor access for **defense in depth**",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018"
     }
   },
   "Categories": [
@@ -33,5 +37,8 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": ""
+  "Notes": "",
+  "CheckAliases": [
+    "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018"
+  ]
 }

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.metadata.json

@@ -1,28 +1,36 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306",
-  "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306.",
+  "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "TTPs/Initial Access"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroups",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** are assessed for **inbound exposure** of **MySQL** on `TCP 3306` from `0.0.0.0/0` or `::/0`.\n\nThe finding reflects whether this port is reachable from any IPv4 or IPv6 address.",
+  "Risk": "**Public MySQL** access lets anyone reach the service, enabling credential brute force and vulnerability exploitation. This threatens:\n- **Confidentiality**: data exfiltration\n- **Integrity**: unauthorized writes or schema changes\n- **Availability**: DoS from abuse or scans",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-mysql-access.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: restrict MySQL (3306) from Internet\nResources:\n  ExampleSecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Limit MySQL access\n      VpcId: <example_resource_id>\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 3306\n          ToPort: 3306\n          CidrIp: 10.0.0.0/8  # Critical: not 0.0.0.0/0 or ::/0; limits MySQL to internal range\n```",
+      "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group in use by the instance\n3. In Inbound rules, click Edit inbound rules\n4. Remove any rule for TCP port 3306 with source 0.0.0.0/0 or ::/0\n5. Add a rule for TCP 3306 only from a trusted source (e.g., specific IP/CIDR or a security group)\n6. Click Save rules",
+      "Terraform": "```hcl\n# Restrict MySQL (3306) from Internet\nresource \"aws_security_group\" \"example_resource_name\" {\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 3306\n    to_port     = 3306\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0 or ::/0; restricts MySQL access\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Apply **least privilege**: restrict `3306` to specific sources or peer security groups only. Keep databases in private subnets and use **VPN**, **bastion**, or application proxies for admin access. Enable **defense in depth** with TLS and strong auth. Never allow `0.0.0.0/0` or `::/0` ingress.",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.metadata.json

@@ -1,28 +1,34 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483",
-  "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Oracle ports 1521 or 2483.",
+  "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Oracle TCP ports 1521 or 2483",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "TTPs/Initial Access"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Oracle ports 1521 or 2483.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** are evaluated for inbound rules that permit public sources (`0.0.0.0/0` or `::/0`) to `TCP 1521` or `TCP 2483`-Oracle listener ports.\n\nThe focus is on rules that make these ports reachable from the Internet over IPv4 or IPv6.",
+  "Risk": "Public Oracle listener exposure enables attackers to:\n- **Brute force** credentials and enumerate services\n- Exploit **listener flaws** for remote access\n- Run unauthorized queries causing **data exfiltration**\n- Launch **DoS** on the listener\n\nThis jeopardizes database confidentiality, integrity, and availability.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
+    "https://support.icompaas.com/support/solutions/articles/62000236318-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-oracle-ports-1521-or-2483-"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: restrict Oracle ports 1521 and 2483 from Internet\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Restrict Oracle ports from Internet\n      VpcId: <example_resource_id>\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 1521\n          ToPort: 1521\n          CidrIp: 10.0.0.0/8  # Critical: do not use 0.0.0.0/0; restrict source to internal range to block Internet\n        - IpProtocol: tcp\n          FromPort: 2483\n          ToPort: 2483\n          CidrIp: 10.0.0.0/8  # Critical: restrict Oracle port 2483 from Internet\n```",
+      "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the resource\n3. Open the Inbound rules tab and click Edit inbound rules\n4. For rules on TCP ports 1521 or 2483 with Source 0.0.0.0/0 or ::/0, delete them or change Source to a specific trusted CIDR (e.g., your internal range)\n5. Click Save rules",
+      "Terraform": "```hcl\n# Restrict Oracle ports 1521 and 2483 from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n  name   = \"<example_resource_name>\"\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 1521\n    to_port     = 1521\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"] # Critical: do not use 0.0.0.0/0; restrict to internal range\n  }\n\n  ingress {\n    from_port   = 2483\n    to_port     = 2483\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"] # Critical: restrict Oracle port 2483 from Internet\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Apply **least privilege** and **defense in depth**: disallow public ingress to `TCP 1521` and `TCP 2483`.\n\nRestrict access to trusted CIDRs or peer security groups, keep databases on private networks, and require **VPN**, **bastion**, or **proxy** access. Enforce **TLS** and segment east-west and north-south traffic.",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.metadata.json

@@ -1,28 +1,37 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432",
-  "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Postgres port 5432.",
+  "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Postgres TCP port 5432",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "TTPs/Initial Access",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Postgres port 5432.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** are evaluated for inbound rules that expose **Postgres** on `TCP 5432` to the Internet. Rules permitting `0.0.0.0/0` or `::/0` to this port, or policies that open all ports publicly, are identified.",
+  "Risk": "Exposing `5432` to the Internet enables credential stuffing and Postgres exploits, risking data disclosure (**confidentiality**), unauthorized changes (**integrity**), and service disruption via brute force or DoS (**availability**).",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-postgresql-access.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 5432 --cidr 0.0.0.0/0",
+      "NativeIaC": "```yaml\n# CloudFormation: restrict Postgres (5432) from the Internet\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: \"<example_resource_name>\"\n      VpcId: \"<example_resource_id>\"\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 5432\n          ToPort: 5432\n          CidrIp: 10.0.0.0/8  # Critical: not 0.0.0.0/0 or ::/0; limits access so 5432 is not open to the Internet\n```",
+      "Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Locate any rule for PostgreSQL (port 5432) with Source 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific CIDR or security group\n6. Click Save rules",
+      "Terraform": "```hcl\n# Security group with Postgres (5432) not exposed to the Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n  name   = \"<example_resource_name>\"\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 5432\n    to_port     = 5432\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"] # Critical: avoid 0.0.0.0/0 or ::/0 to prevent Internet exposure\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Apply **least privilege** on security groups: remove `0.0.0.0/0` and `::/0` for `5432`, allow only trusted CIDRs or private peers. Prefer **private access** (VPC-only) via VPN, bastion, or proxy. Add **defense in depth** with SG references and network ACLs, and enforce TLS and strong authentication.",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.metadata.json

@@ -1,28 +1,37 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379",
-  "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis port 6379.",
+  "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Redis TCP port 6379",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "TTPs/Initial Access",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis port 6379.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** permitting Internet sources (`0.0.0.0/0` or `::/0`) to `TCP 6379` are identified, indicating Redis is reachable from public networks",
+  "Risk": "Public Redis access undermines **confidentiality, integrity, and availability**:\n- Read keys and secrets\n- Modify or flush data and configs\n- Exhaust memory for DoS\nAttackers can brute-force `AUTH`, exploit replication or modules for code execution, and pivot within the VPC.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
+    "https://support.icompaas.com/support/solutions/articles/62000233806-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-6379-redis-"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 6379 --cidr 0.0.0.0/0",
+      "NativeIaC": "```yaml\n# CloudFormation: restrict Redis (6379) from Internet\nResources:\n  SecureSecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Restrict Redis access\n      VpcId: <example_resource_id>\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 6379\n          ToPort: 6379\n          CidrIp: 10.0.0.0/8  # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR\n```",
+      "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule allowing TCP port 6379 with Source 0.0.0.0/0 or ::/0\n5. Delete that rule (or change Source to a trusted CIDR or security group)\n6. Click Save rules",
+      "Terraform": "```hcl\n# Security group with Redis limited to trusted sources\nresource \"aws_security_group\" \"secure\" {\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 6379\n    to_port     = 6379\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"] # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Restrict Redis to **private connectivity** and apply **least privilege**:\n- Allow `6379` only from required app hosts, security groups, or CIDRs\n- Prefer VPC/private networks or VPN over public IPs\n- Enforce Redis `AUTH` and TLS, bind to private interfaces\n- Use segmentation and monitoring for **defense in depth**",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.metadata.json

@@ -1,28 +1,36 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
-  "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Windows SQL Server ports 1433 or 1434.",
+  "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Microsoft SQL Server ports 1433 and 1434",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "TTPs/Initial Access/Unauthorized Access",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Windows SQL Server ports 1433 or 1434.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "Description": "**EC2 security groups** with inbound rules that allow Internet sources (`0.0.0.0/0`, `::/0`) to reach **Microsoft SQL Server** on `TCP 1433` or `TCP 1434`",
+  "Risk": "**Internet-exposed SQL ports** enable credential brute force, service enumeration, and remote exploitation. Compromise can lead to unauthorized queries, data exfiltration or tampering, and outages via destructive commands, degrading **confidentiality**, **integrity**, and **availability**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
+    "https://support.icompaas.com/support/solutions/articles/62000223371-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-windows-sql-server-ports-1433-or-14"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":1433,\"ToPort\":1433,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":1434,\"ToPort\":1434,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]]'",
+      "NativeIaC": "```yaml\n# CloudFormation: restrict SQL Server ports from Internet\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Restrict SQL ports\n      VpcId: <example_resource_id>\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 1433\n          ToPort: 1433\n          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0; limits exposure to internal range\n        - IpProtocol: tcp\n          FromPort: 1434\n          ToPort: 1434\n          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0; blocks Internet access\n```",
+      "Other": "1. Open the AWS Console > EC2 > Security Groups\n2. Select the target security group and open Inbound rules\n3. Find rules allowing TCP 1433 or 1434 from 0.0.0.0/0 or ::/0\n4. Delete those rules (or change Source to a specific CIDR or security group)\n5. Click Save rules",
+      "Terraform": "```hcl\n# Restrict SQL Server ports from Internet\nresource \"aws_security_group\" \"<example_resource_name>\" {\n  name   = \"<example_resource_name>\"\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 1433\n    to_port     = 1433\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"]  # CRITICAL: not 0.0.0.0/0; restricts Internet access\n  }\n\n  ingress {\n    from_port   = 1434\n    to_port     = 1434\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"]  # CRITICAL: not 0.0.0.0/0; blocks Internet exposure\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Apply **least privilege** on network access:\n- Restrict SQL ingress to trusted IPs or via VPN/bastion\n- Place databases in private subnets; allow only app-tier sources\n- Avoid `0.0.0.0/0` and `::/0`\n- Use **defense in depth** with network ACLs/firewalls\n- Monitor auth failures and rate-limit repeated attempts",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.metadata.json

@@ -1,28 +1,37 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23",
-  "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.",
+  "CheckTitle": "Security group does not allow ingress from the Internet to TCP port 23 (Telnet)",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "TTPs/Initial Access"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** are evaluated for rules that allow **inbound Telnet** on `TCP 23` from the Internet (`0.0.0.0/0` or `::/0`).",
+  "Risk": "Public **Telnet** exposes cleartext credentials and remote shell access.\n- Brute-force and credential interception enable account takeover\n- Command execution enables data theft and lateral movement\n\nThis threatens confidentiality and integrity and can degrade availability through misuse.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html",
+    "https://support.icompaas.com/support/solutions/articles/62000233790-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-23-telnet-",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-telnet-access.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":23,\"ToPort\":23,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'",
+      "NativeIaC": "```yaml\n# CloudFormation: restrict Telnet (port 23) from Internet\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Restrict Telnet\n      VpcId: <example_resource_id>\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 23\n          ToPort: 23\n          CidrIp: 10.0.0.0/8  # CRITICAL: Restricts Telnet (23) to internal range; removes Internet-wide (0.0.0.0/0) access\n```",
+      "Other": "1. In the AWS console, go to VPC > Security Groups\n2. Select the affected security group and open Inbound rules\n3. Click Edit inbound rules\n4. Find any rule allowing TCP port 23 (Telnet) from 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific trusted CIDR\n6. Save rules",
+      "Terraform": "```hcl\nresource \"aws_security_group\" \"<example_resource_name>\" {\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 23\n    to_port     = 23\n    protocol    = \"tcp\"\n    cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: Restricts Telnet (23); do not use 0.0.0.0/0 or ::/0\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Remove rules permitting Internet access to `TCP 23` from `0.0.0.0/0` or `::/0`. Disable **Telnet** on hosts. Prefer **SSH** or **SSM** and apply **least privilege** network rules. Restrict admin access to trusted IPs, VPN, or private endpoints, and use **defense in depth** with NACLs and logging.",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.metadata.json

@@ -1,28 +1,36 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_allow_wide_open_public_ipv4",
-  "CheckTitle": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.",
+  "CheckTitle": "Security group has no ingress or egress rules with public IPv4 CIDR ranges from /1 to /23",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "TTPs/Initial Access/Unauthorized Access"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.",
-  "Risk": "If Security groups are not properly configured the attack surface is increased.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** with rules that permit non-RFC1918 IPv4 ranges wider than `/24` are identified across both **ingress** and **egress**.\n\nThe focus is on public CIDRs (`/1`-`/23`) that broadly expose sources or destinations, not on private networks.",
+  "Risk": "Over-broad public CIDRs expand exposure and enable:\n- **Confidentiality** loss via unauthorized access and exfiltration\n- **Integrity** compromise by exploiting exposed services\n- **Availability** impact from scanning and abuse\n\nOpen egress further allows **C2** beacons and bulk data exfiltration to untrusted IPs.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://support.icompaas.com/support/solutions/articles/62000229600-ensure-vpc-security-groups-not-wide-open-public-ipv4-cidr-ranges-non-rfc1918-",
+    "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: ensure no public IPv4 CIDR wider than /24\nResources:\n  \"<example_resource_name>\":\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: \"sg\"\n      VpcId: \"<example_resource_id>\"\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 443\n          ToPort: 443\n          CidrIp: 203.0.113.0/24  # Critical: /24 (or private RFC1918) avoids wide-open public /1-/23\n```",
+      "Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the security group with the finding\n3. Click Edit inbound rules (and Edit outbound rules if needed)\n4. For any rule with a public IPv4 CIDR mask /1-/23, delete it or change the CIDR to a private RFC1918 range or to /24 or more specific (e.g., 203.0.113.0/24)\n5. Save rules",
+      "Terraform": "```hcl\n# Terraform: ensure no public IPv4 CIDR wider than /24\nresource \"aws_security_group\" \"<example_resource_name>\" {\n  name   = \"<example_resource_name>\"\n  vpc_id = \"<example_resource_id>\"\n\n  ingress {\n    from_port   = 443\n    to_port     = 443\n    protocol    = \"tcp\"\n    cidr_blocks = [\"203.0.113.0/24\"] # Critical: /24 (or private RFC1918) avoids wide-open public /1-/23\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.",
-      "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"
+      "Text": "Apply **least privilege** on security groups:\n- Allow only known IPs (prefer `/32` or tight CIDRs)\n- Use **private connectivity** (VPN, Direct Connect, private endpoints)\n- Restrict and log **egress**; deny by default\n- Segment with security group references and **network ACLs** for **defense-in-depth**",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_wide_open_public_ipv4"
     }
   },
   "Categories": [

prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json

@@ -1,31 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_default_restrict_traffic",
-  "CheckTitle": "Ensure the default security group of every VPC restricts all traffic.",
+  "CheckTitle": "VPC default security group has no inbound or outbound rules",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure the default security group of every VPC restricts all traffic.",
-  "Risk": "Even having a perimeter firewall, having security groups open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.",
+  "ResourceGroup": "network",
+  "Description": "**Default VPC security group** should have **no inbound or outbound rules**. This evaluates whether the group allows any traffic-ingress, egress, or self-referencing-instead of remaining empty.",
+  "Risk": "Permissive rules in the **default security group** mean instances that inherit it can communicate widely. This enables **lateral movement**, **port scanning**, and **data exfiltration**; unrestricted egress aids **C2**. Confidentiality and integrity are reduced, and the blast radius of a compromise grows.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html",
+    "https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
       "NativeIaC": "",
-      "Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_4#aws-console",
-      "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_4#terraform"
+      "Other": "1. Open the AWS Console and go to VPC > Security > Security groups\n2. Select the security group named \"default\" for the affected VPC\n3. In Inbound rules, click Edit inbound rules, delete all rules, and Save\n4. In Outbound rules, click Edit outbound rules, delete all rules, and Save\n5. Repeat for each VPC that has this finding",
+      "Terraform": "```hcl\nresource \"aws_default_security_group\" \"<example_resource_name>\" {\n  vpc_id = \"<example_vpc_id>\"\n\n  ingress = []  # Critical: removes all inbound rules from the default SG\n  egress  = []  # Critical: removes all outbound rules from the default SG\n}\n```"
     },
     "Recommendation": {
-      "Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive security groups. Recommended best practices is to narrow the definition for the minimum ports required.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html"
+      "Text": "Enforce **least privilege**: keep the default group empty by removing all ingress and egress rules. Use dedicated security groups per workload with explicit sources, destinations, and ports. Regularly review for broad CIDRs like `0.0.0.0/0` and apply **defense in depth** via automation and policy guardrails.",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_default_restrict_traffic"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "trust-boundaries"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.metadata.json

@@ -1,28 +1,33 @@
 {
   "Provider": "aws",
   "CheckID": "ec2_securitygroup_from_launch_wizard",
-  "CheckTitle": "Security Groups created by EC2 Launch Wizard.",
+  "CheckTitle": "Security group not created using the EC2 Launch Wizard",
   "CheckType": [
-    "Infrastructure Security"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "securitygroup",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Security Groups created by EC2 Launch Wizard.",
-  "Risk": "Security Groups Created on the AWS Console using the EC2 wizard may allow port 22 from 0.0.0.0/0.",
+  "ResourceGroup": "network",
+  "Description": "**EC2 security groups** whose names include `launch-wizard` are identified as created by the **EC2 Launch Wizard**, distinguishing auto-generated groups from curated, baseline-controlled groups.",
+  "Risk": "Wizard-generated groups often include **overly permissive rules** (e.g., `0.0.0.0/0` to admin ports), expanding exposure. Attackers can run **port scans** and **brute-force** to gain entry, then **lateral movement** and **data exfiltration**, impacting **confidentiality** and **integrity**; broad egress aids command-and-control.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-prefixed-with-launch-wizard.html",
+    "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-prefixed-with-launch-wizard.html",
-      "Terraform": ""
+      "CLI": "aws ec2 delete-security-group --group-id <SECURITY_GROUP_ID>",
+      "NativeIaC": "```yaml\n# CloudFormation: create a security group not named by Launch Wizard\nResources:\n  <example_resource_name>:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: SG not created by Launch Wizard\n      VpcId: <example_resource_id>\n      GroupName: <example_resource_name>  # Critical: name does NOT contain \"launch-wizard\" to avoid FAIL\n```",
+      "Other": "1. In the AWS console, go to EC2 > Network & Security > Security Groups\n2. In the search box, filter by Name contains \"launch-wizard\"\n3. For each matching group, open the References tab and remove it from any ENIs/instances by replacing it with a different security group\n4. Select the launch-wizard security group and choose Actions > Delete security group > Delete\n5. Verify no security groups remain with names containing \"launch-wizard\"",
+      "Terraform": "```hcl\n# Create a security group not named by Launch Wizard\nresource \"aws_security_group\" \"<example_resource_name>\" {\n  name   = \"<example_resource_name>\"  # Critical: name does NOT contain \"launch-wizard\" to avoid FAIL\n  vpc_id = \"<example_resource_id>\"\n}\n```"
     },
     "Recommendation": {
-      "Text": "Apply Zero Trust approach. Implement a process to scan and remediate security groups created by the EC2 Wizard. Recommended best practices is to use an authorized security group.",
-      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html"
+      "Text": "Replace or harden these groups. Apply **least privilege**: restrict inbound to required sources, avoid public admin ports, and minimize egress. Use approved baseline security groups, enforce change control with IaC and guardrails, prefer private administration (bastion or Session Manager), and remove unused rules.",
+      "Url": "https://hub.prowler.com/check/ec2_securitygroup_from_launch_wizard"
     }
   },
   "Categories": [],