CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Mastering AWS Config Rules for Security Groups
Understand AWS Config rules for security groups. Learn why 'restricted-common-ports' is the key to preventing unrestricted access.
When it comes to AWS security, misconfigured security groups often trip candidates during the exam. Many options seem plausible, but only one truly addresses the risk of unrestricted access effectively.
The question
Your organization is using AWS Config to assess the compliance of its resources. However, you are concerned about the potential risks from misconfigured security groups. What AWS Config rule would you implement to ensure that security groups do not allow unrestricted inbound access?
- A. restricted-ssh
- B. restricted-ports
- C. restricted-common-ports
- D. secure-s3-bucket
Think before you scroll
Before making a choice, consider the specific purpose of each AWS Config rule. Focus on which rule directly addresses the concern of unrestricted inbound access through security groups.
The answer
The correct option is C. restricted-common-ports. This rule checks that security groups do not allow inbound traffic from 0.0.0.0/0 for common ports like SSH (22) and HTTP (80). It is designed explicitly to prevent unrestricted access to your resources.
Why the other options lose
- A. restricted-ssh: This rule only checks for SSH access and does not cover other common ports. While important, it does not address the broader concern of unrestricted access across multiple protocols.
- B. restricted-ports: This option is vague and does not exist as a standard rule in AWS Config. It lacks the specificity needed to be a reliable choice for ensuring security group compliance.
- D. secure-s3-bucket: This rule pertains to S3 bucket security, which is unrelated to security groups. It does not address the issue of inbound access controls in security groups.
The concept behind it
Understanding AWS Config rules is critical for maintaining security in your cloud environment. The principle behind restricted-common-ports is to monitor and enforce compliance for common protocols that are frequently targeted for unauthorized access. This rule helps you maintain tighter security by ensuring that such access is not permitted from any source.
Exam trap to remember
Remember: Always consider the specific scope of AWS Config rules. The more comprehensive the rule, the better it addresses security concerns. Focus on common ports to prevent unrestricted access effectively.