VPC security group rules permit ingress from '0.0.0.0/0' to port 3389 Affecting VPC service in AWS

Remove any invalid ingress block from the aws_security_group.

An ingress block is invalid if it contains both of the following:

• A 0.0.0.0/0 in the cidr_blocks field
• 3389 is within the port range defined from from_port to to_port, OR from_port and to_port are both set to 0

Example configuration:

resource "aws_security_group" "example" {
  ingress {
    cidr_blocks = [10.0.0.0/16]
    from_port   = 3389
    to_port     = 3389
    # other required fields here
  }
}

Remove any invalid SecurityGroupIngress block from the AWS::EC2::SecurityGroup.

A SecurityGroupIngress block is invalid if it contains both of the following:

• A 0.0.0.0/0 in the CidrIp field
• 3389 is within the port range defined from FromPort to ToPort, OR FromPort and ToPort are both set to 0

Example configuration:

JSON example configuration:

{
  "ValidSecurityGroup02": {
    "Type": "AWS::EC2::SecurityGroup",
    "Properties": {
      "SecurityGroupIngress": [
        {
          "CidrIp": "10.0.0.0/16",
          "FromPort": 3389,
          "ToPort": 3389,
          "IpProtocol": "tcp"
        }
      ]
    }
    # other required fields here
  }
}

YAML example configuration:

ValidSecurityGroup02:
  Type: AWS::EC2::SecurityGroup
  Properties:
    SecurityGroupIngress:
    - CidrIp: '10.0.0.0/16'
      FromPort: 3389
      ToPort: 3389
      IpProtocol: "tcp"
  # other required fields here