Enhancing Network Security with EC2 Security Groups with Amazon Q Developer

$ q chat
Things to try
• Fix the build failures in this project.
• List my s3 buckets in us-west-2.
• Write unit tests for my application.
• Help me understand my git status

/acceptall    Toggles acceptance prompting for the session.
/profile      (Beta) Manage profiles for the chat session
/context      (Beta) Manage context files for a profile
/help         Show the help dialogue
/quit         Quit the application

> What are the key differences between Security Groups and Network ACLs?

# Security Groups vs Network ACLs

Security Groups and Network ACLs are both important AWS network security controls, but they operate differently:

## Security Groups
• **Stateful**: Return traffic is automatically allowed, regardless of outbound rules
• **Instance level**: Act as a virtual firewall for EC2 instances and other AWS resources
• **Allow rules only**: Can only specify allow rules, not deny rules
• **Evaluated as a whole**: All rules are evaluated before deciding to allow traffic
• **Apply to an instance**: Associated with instances, not subnets
• **Default configuration**: By default, all outbound traffic is allowed

## Network ACLs
• **Stateless**: Return traffic must be explicitly allowed by rules
• **Subnet level**: Control traffic in and out of subnets
• **Allow and deny rules**: Can specify both allow and deny rules
• **Rule processing order**: Rules are evaluated in numerical order (lowest first)
• **Apply to all instances**: Automatically apply to all instances in the associated subnet
• **Default configuration**: Default NACL allows all inbound and outbound traffic

Network ACLs provide a broader, subnet-level security layer, while Security Groups offer more granular control at the instance level. For comprehensive security, it's best practice to use both in combination.

$ q chat

> Show how to create a basic web server security group

# Step 1: Get your VPC ID (if you don't already know it)
aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId,Name:Tags[?Key=='Name'].Value|[0],CidrBlock:CidrBlock}" --output table

# Step 2: Create the security group (replace vpc-xxxxxxxx with your actual VPC ID)
aws ec2 create-security-group \
    --group-name WebServerSG \
    --description "Security group for web servers" \
    --vpc-id vpc-xxxxxxxx

# Step 3: Add inbound rules for HTTP and HTTPS from anywhere
aws ec2 authorize-security-group-ingress \
    --group-id sg-xxxxxxxxxxxxxxxxx \
    --protocol tcp \
    --port 80 \
    --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
    --group-id sg-xxxxxxxxxxxxxxxxx \
    --protocol tcp \
    --port 443 \
    --cidr 0.0.0.0/0

# Step 4: Add inbound rule for SSH from a specific IP range (replace with your IP range)
aws ec2 authorize-security-group-ingress \
    --group-id sg-xxxxxxxxxxxxxxxxx \
    --protocol tcp \
    --port 22 \
    --cidr 192.168.1.0/24

$ q chat

> what are the commands to audit security group?

# AWS CLI Commands to Audit Security Groups

Here's a comprehensive list of AWS CLI commands to audit your security groups:

## Basic Security Group Information

bash
# List all security groups with basic details
aws ec2 describe-security-groups --output table

# Get detailed information about a specific security group
aws ec2 describe-security-groups --group-ids sg-12345678

# List security groups with their VPC IDs
aws ec2 describe-security-groups --query 'SecurityGroups[*].[GroupId,GroupName,VpcId]' --output table

## Finding Overly Permissive Rules

bash
# Find security groups with 0.0.0.0/0 inbound access
aws ec2 describe-security-groups \
  --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
  --query 'SecurityGroups[*].{Name:GroupName,ID:GroupId,Rules:IpPermissions[?contains(IpRanges[].CidrIp, `0.0.0.0/0`)]}' \
  --output json

# Find security groups with specific ports open to the world (example: SSH port 22)
aws ec2 describe-security-groups \
  --filters Name=ip-permission.cidr,Values=0.0.0.0/0 Name=ip-permission.from-port,Values=22 \
  --query 'SecurityGroups[*].{Name:GroupName,ID:GroupId}' \
  --output table

# Find security groups with all ports open
aws ec2 describe-security-groups \
  --filters Name=ip-permission.protocol,Values=-1 \
  --query 'SecurityGroups[*].{Name:GroupName,ID:GroupId}' \
  --output table

## Identifying Unused Security Groups

bash
# Get all security groups
aws ec2 describe-security-groups --query 'SecurityGroups[*].GroupId' --output text > all_sgs.txt

# Get security groups used by EC2 instances
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].SecurityGroups[*].GroupId' \
  --output text | tr '\t' '\n' | sort -u > used_sgs.txt

# Get security groups used by RDS instances
aws rds describe-db-instances \
  --query 'DBInstances[*].VpcSecurityGroups[*].VpcSecurityGroupId' \
  --output text | tr '\t' '\n' | sort -u >> used_sgs.txt

# Get security groups used by ELBs
aws elb describe-load-balancers \
  --query 'LoadBalancerDescriptions[*].SecurityGroups' \
  --output text | tr '\t' '\n' | sort -u >> used_sgs.txt

# Get security groups used by ALBs/NLBs
aws elbv2 describe-load-balancers \
  --query 'LoadBalancers[*].SecurityGroups' \
  --output text | tr '\t' '\n' | sort -u >> used_sgs.txt

# Find unused security groups (requires sort, uniq, and comm commands)
sort all_sgs.txt | uniq > all_sgs_sorted.txt
sort used_sgs.txt | uniq > used_sgs_sorted.txt
comm -23 all_sgs_sorted.txt used_sgs_sorted.txt > unused_sgs.txt

## Checking Default Security Groups

bash
# List all default security groups
aws ec2 describe-security-groups \
  --filters Name=group-name,Values=default \
  --query 'SecurityGroups[*].{ID:GroupId,VPC:VpcId,InboundRules:IpPermissions,OutboundRules:IpPermissionsEgress}' \
  --output json

## Security Group References

bash
# Find security groups that reference other security groups
aws ec2 describe-security-groups \
  --query 'SecurityGroups[?length(IpPermissions[?length(UserIdGroupPairs)>`0`])>`0`].{Name:GroupName,ID:GroupId}' \
  --output table

## Security Group Usage

bash
# Find which EC2 instances use a specific security group
aws ec2 describe-instances \
  --filters Name=instance.group-id,Values=sg-12345678 \
  --query 'Reservations[*].Instances[*].[InstanceId,Tags[?Key==`Name`].Value|[0]]' \
  --output table

# Find which ENIs use a specific security group
aws ec2 describe-network-interfaces \
  --filters Name=group-id,Values=sg-12345678 \
  --query 'NetworkInterfaces[*].{ID:NetworkInterfaceId,PrivateIP:PrivateIpAddress}' \
  --output table

## Checking for Compliance

bash
# Check if security groups comply with specific port restrictions (example: no port 3389 RDP)
aws ec2 describe-security-groups \
  --filters Name=ip-permission.from-port,Values=3389 \
  --query 'SecurityGroups[*].{Name:GroupName,ID:GroupId}' \
  --output table

## Exporting Security Group Rules for Documentation

bash
# Export all security group rules to a JSON file
aws ec2 describe-security-groups \
  --query 'SecurityGroups[*].{Name:GroupName,ID:GroupId,Description:Description,InboundRules:IpPermissions,OutboundRules:IpPermissionsEgress}' \
  --output json > security_groups_audit.json