Panther low experimental python

AWS VPC Default Security Group Restrictions

This policy validates that the default Security Group for a given AWS VPC is restricting all inbound and outbound traffic.

View Source

Detection Logic

from panther_aws_helpers import BadLookup, resource_lookup


def policy(resource):
    # pylint: disable=line-too-long
    default_id = f"arn:aws:ec2:{resource['Region']}:{resource['AccountId']}:security-group/{resource['DefaultSecurityGroupId']}"
    try:
        default_sg = resource_lookup(default_id)
    except BadLookup:
        return True
    return default_sg["IpPermissions"] is None and default_sg["IpPermissionsEgress"] is None

Field Validations

Loading…

Comments (0)

Loading comments...