Panther medium experimental python

AWS Security Group Restricts Traffic Leaving CDE

This policy validates that there are restrictions on what type of traffic may leave Security Groups that are considered with the scope of the PCI CDE. These restrictions help ensure that cardholder data does not leave the CDE.

View Source

Detection Logic

from ipaddress import ip_network


def policy(resource):

    for permission in resource["IpPermissionsEgress"] or []:
        # Check if any traffic can leave this security group to public IP space
        for ip_range in permission["IpRanges"] or []:
            if ip_range["CidrIp"] == "0.0.0.0/0" or not ip_network(ip_range["CidrIp"]).is_private:
                return False
        for ip_range in permission["Ipv6Ranges"] or []:
            if ip_range["CidrIpv6"] == "::/0" or not ip_network(ip_range["CidrIpv6"]).is_private:
                return False

    return True

Field Validations

Loading…

Comments (0)

Loading comments...