Risk Level: High
Cloud Entity: Amazon EC2 Instance
CloudGuard Rule ID: D9.AWS.NET.AG2.1.Instance.389.TCP
Covered by Spectral: No
Instance where isPublic=true and nics contain [ subnet.routeTable.associations length()>0 ] and nics contain [ subnet.routeTable.routes contain [ destinationCidrBlock='0.0.0.0/0' and gatewayId regexMatch /gw/ ] ] should not have inboundRules contain [ port<=389 and portTo>=389 and protocol in ('TCP', 'ALL') and scope isPublic() and scope numberOfHosts()>=32 ]
It is recommended to remove the rules that allow permissive SSH/Remote/Admin access.
If public interface exists, remove it and limit the access scope within the VPC only to applications or instances that requires access.
As a further protection, use CloudGuard Dynamic Access Leasing to limit access to SSH/Remote Desktop only from allowed sources and only when needed.
For more information please refer to: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Network-Security/DynAccessLease.html?tocpath=Network%20Security%7C_____3
Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers.
Updated 16 days ago