AWS Config と SSM Automation を活用した高リスクセキュリティグループの自動検知と修復を行う方法

description: Disable SSH and RDP ports opened to IP address specified, or to all addresses if no address is specified. Similar to the [RevokeSecurityGroupIngress](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupIngress.html ) API, the security group must have existing rules specifically on the SSH and RDP ports in order for ingress to be disabled.
schemaVersion: '0.3'
assumeRole: '{{ AutomationAssumeRole }}'
parameters:
  GroupId:
    type: String
    description: (Required) Security Group ID
    allowedPattern: ^([s][g]\-)([0-9a-f]){1,}$
  IpAddressToBlock:
    type: String
    description: (Optional) Additional Ipv4 or Ipv6 address to block access from (ex:1.2.3.4/32)
    allowedPattern: (^$)|^((25[0-5]|(2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3})|(^((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)::((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?))|(^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}))\/(25[0-5]|2[0-4]\d|[0-1]?\d?\d)$
    default: ''
  AutomationAssumeRole:
    type: String
    description: (Optional) The ARN of the role that allows Automation to perform the actions on your behalf.
    default: ''
mainSteps:
  - name: CustomIpCheck
    action: aws:branch
    inputs:
      Choices:
        - NextStep: DisableSSHFromCustomIpV6
          And:
            - Not:
                Variable: '{{IpAddressToBlock}}'
                StringEquals: ''
            - Variable: '{{ IpAddressToBlock }}'
              Contains: ':'
        - NextStep: DisableSSHFromCustomIpV4
          And:
            - Not:
                Variable: '{{IpAddressToBlock}}'
                StringEquals: ''
            - Not:
                Variable: '{{ IpAddressToBlock }}'
                Contains: ':'
      Default: DisableSSHFromIpV4
  - name: DisableSSHFromIpV4
    action: aws:executeAwsApi
    nextStep: DisableHTTPFromIpV4
    isEnd: false
    onFailure: step:DisableHTTPFromIpV4
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          IpRanges:
            - CidrIp: 0.0.0.0/0
  - name: DisableHTTPFromIpV4
    action: aws:executeAwsApi
    nextStep: DisableHTTPSFromIpV4
    isEnd: false
    onFailure: step:DisableHTTPSFromIpV4
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          IpRanges:
            - CidrIp: 0.0.0.0/0
  - name: DisableHTTPSFromIpV4
    action: aws:executeAwsApi
    nextStep: DisableSSHFromIpV6
    isEnd: false
    onFailure: step:DisableSSHFromIpV6
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          IpRanges:
            - CidrIp: 0.0.0.0/0
  - name: DisableSSHFromIpV6
    action: aws:executeAwsApi
    nextStep: DisableRDPFromIpV4
    isEnd: false
    onFailure: step:DisableRDPFromIpV4
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          Ipv6Ranges:
            - CidrIpv6: '::/0'
  - name: DisableRDPFromIpV4
    action: aws:executeAwsApi
    nextStep: DisableRDPFromIpV6
    isEnd: false
    onFailure: step:DisableRDPFromIpV6
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          IpRanges:
            - CidrIp: 0.0.0.0/0
  - name: DisableRDPFromIpV6
    action: aws:executeAwsApi
    isEnd: true
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          Ipv6Ranges:
            - CidrIpv6: '::/0'
  - name: DisableSSHFromCustomIpV4
    action: aws:executeAwsApi
    nextStep: DisableRDPFromCustomIpV4
    isEnd: false
    onFailure: step:DisableRDPFromCustomIpV4
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          IpRanges:
            - CidrIp: '{{ IpAddressToBlock }}'
  - name: DisableRDPFromCustomIpV4
    action: aws:executeAwsApi
    isEnd: true
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          IpRanges:
            - CidrIp: '{{ IpAddressToBlock }}'
  - name: DisableSSHFromCustomIpV6
    action: aws:executeAwsApi
    nextStep: DisableRDPFromCustomIpV6
    isEnd: false
    onFailure: step:DisableRDPFromCustomIpV6
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          Ipv6Ranges:
            - CidrIpv6: '{{ IpAddressToBlock }}'
  - name: DisableRDPFromCustomIpV6
    action: aws:executeAwsApi
    isEnd: true
    inputs:
      Service: ec2
      Api: RevokeSecurityGroupIngress
      GroupId: '{{GroupId}}'
      IpPermissions:
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          Ipv6Ranges:
            - CidrIpv6: '{{ IpAddressToBlock }}'