Purpose of This Lesson

This hands-on lesson demonstrates how to combine AWS Config with AWS Systems Manager Automation to detect and remediate EC2 security groups that allow unrestricted inbound access to unauthorized ports.

The example permits public access to TCP port 80 for web traffic while identifying other unrestricted inbound TCP or UDP access as noncompliant. SSM Automation then removes public ingress rules from the affected security group.

Key Concepts

• AWS Config rule: Evaluates resources against a compliance requirement and identifies compliant or noncompliant resources.
• Managed Config rule: The lesson uses VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS, which checks whether security groups allowing unrestricted incoming traffic permit connections only on authorized TCP or UDP ports.
• Authorized TCP ports: The rule is configured with TCP port 80 as the allowed public port.
• Systems Manager Automation: Executes a remediation runbook against a noncompliant resource.
• Automation assume role: An IAM role that gives Systems Manager Automation permission to perform the remediation.
• Security group ingress: The inbound rules being evaluated and, when necessary, revoked.
• Unrestricted source: The IPv4 CIDR 0.0.0.0/0, meaning any IPv4 source address.

Detection and Automated Remediation Workflow

1. Create the IAM role for Automation

Create an IAM role trusted by the AWS Systems Manager service. Attach the managed policy identified in the lesson as Amazon SSM automation role. This provides the baseline permissions needed by the Automation workflow.

Add an inline policy that permits the remediation action:

{
  "Effect": "Allow",
  "Action": "ec2:RevokeSecurityGroupIngress",
  "Resource": "*"
}

The exact policy document should be reviewed in the course-provided IAM Role.json material before use. The decisive permission for this remediation is the ability to revoke security group ingress.

2. Configure the AWS Config rule

Use the managed rule named:

VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS

Configure the rule so that:

• Authorized TCP ports: 80
• Authorized UDP ports: None, unless the environment requires them
• Resources evaluated: EC2 security groups

The rule identifies security groups as noncompliant when they allow unrestricted incoming traffic and include ports that are not listed in the rule parameters.

3. Add the remediation configuration

Configure the rule’s remediation action with the AWS-managed Automation runbook:

AWS-DisablePublicAccessForSecurityGroup

Supply the required runbook parameters:

Parameter	Value
Resource ID / group ID	The affected security group’s group ID
IP address to block	0.0.0.0/0
Automation assume IAM role	ARN of the IAM role created for Systems Manager Automation

The remediation can be triggered manually for a selected noncompliant resource, as demonstrated in the lesson. AWS Config queues the action, after which the security group’s ingress rules can be refreshed and checked.

4. Validate the result

A useful validation sequence is:

1. Review the security group’s inbound rules before remediation.
2. Re-evaluate the AWS Config rule.
3. Confirm that the security group is listed as noncompliant.
4. Select the affected resource and start remediation.
5. Refresh the EC2 security group rules.
6. Verify that unauthorized public ingress rules were removed while TCP port 80 remained allowed.

In the demonstration, SSH and RDP rules allowing access from any source were removed. ICMP was not removed because the rule was evaluating TCP-related authorized ports. The lesson also observed that port 8181 was not removed, so actual results should always be validated rather than assumed.

Exam- or Assessment-Relevant Takeaways

• For a requirement to detect configuration drift or noncompliance across AWS resources, consider AWS Config rules.
• For automatic corrective actions after a Config finding, consider Config remediation backed by Systems Manager Automation.
• The remediation runbook needs an IAM role that Systems Manager can assume.
• The role must have the permissions required by the Automation workflow, including the ability to revoke security group ingress for this use case.
• The managed rule’s parameters determine what is compliant. Allowing TCP port 80 does not make every other public port compliant.
• 0.0.0.0/0 represents unrestricted IPv4 access and is a critical clue in security-group compliance scenarios.
• A rule evaluation and remediation are separate operations: Config detects the issue, while Automation performs the change.
• Always distinguish TCP, UDP, and other traffic types. A TCP-focused configuration does not necessarily remediate ICMP behavior.
• Remediation can be removed after testing, and the Config rule can be deleted when the temporary lab configuration is no longer needed.

Tool / Feature Decision Guide

Requirement	Appropriate feature or action	Reason
Evaluate security groups against a stated compliance condition	AWS Config managed rule	Config continuously or manually evaluates resource configuration against rule parameters.
Permit public web access but restrict other public ports	VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS with TCP port 80 authorized	The rule can treat port 80 as an exception while detecting other unauthorized unrestricted ports.
Correct a detected noncompliant security group	Systems Manager Automation remediation	Automation can execute the remediation runbook and revoke public ingress.
Identify the resource to remediate	Security group group ID	The remediation runbook requires the affected security group’s identifier.
Define the public source being blocked	0.0.0.0/0	This targets unrestricted IPv4 access.
Handle traffic types not covered by the configured rule	Review the rule’s TCP/UDP parameters and validate separately	A TCP configuration does not automatically explain or remediate ICMP behavior.
Test the workflow temporarily	Manually re-evaluate and remediate, then remove remediation and delete the rule	This validates behavior without leaving the lab control in place.

Common Traps / Misconceptions

• Allowing port 80 does not allow all web-related or application ports. Only the ports specified in the Config rule parameters are authorized.
• AWS Config does not itself revoke the security group rule. Config detects the finding; the configured SSM Automation remediation makes the change.
• The runbook does not work without the correct assume role. The Automation role ARN must be supplied, and the role needs the permissions required to revoke ingress.
• 0.0.0.0/0 is not a port. It is the unrestricted IPv4 source CIDR passed as the address to block.
• TCP, UDP, and ICMP are not interchangeable. A rule configured around authorized TCP ports may not remove ICMP access.
• A successful Config evaluation does not guarantee every expected rule was changed. Refresh the security group and inspect the actual result; the demonstration showed an unexpected outcome for port 8181.
• A noncompliant result may not appear immediately. Re-evaluation and remediation can take time, and the remediation action may initially be queued.
• Temporary remediation should not be left enabled unintentionally. After a lab or test, remove the remediation configuration and delete the temporary Config rule if it is no longer required.

Real-World Engineer / Analyst Notes

• Treat automated revocation as a change-management event. A rule that is technically noncompliant may support a legitimate application, administrative workflow, or monitoring system.
• Before enabling remediation broadly, test the runbook against representative security groups and confirm that the authorized-port parameters match the application’s requirements.
• Record the IAM role ARN, runbook name, rule parameters, and expected traffic types as part of the operational design.
• Validate both the compliance state and the underlying security group. A Config status is useful, but the actual inbound rules are the final evidence of what traffic is allowed.
• Be cautious with a remediation that targets 0.0.0.0/0; public access may be intentional for HTTP, but public SSH, RDP, or other administrative ports usually requires stronger justification.
• The lesson’s observed result reinforces the need to investigate discrepancies rather than assuming the managed rule and remediation affected every visible rule.

Quick Reference Summary

Detection rule:       VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS
Allowed TCP port:     80
Public IPv4 source:   0.0.0.0/0
Remediation runbook:  AWS-DisablePublicAccessForSecurityGroup
Resource identifier:  Security group group ID
Key IAM action:       ec2:RevokeSecurityGroupIngress
Detection service:    AWS Config
Remediation service:  AWS Systems Manager Automation

Core sequence:

IAM Automation role
        ↓
AWS Config managed rule
        ↓
Noncompliant security group
        ↓
SSM Automation remediation
        ↓
Ingress rules revoked and configuration validated

Flashcards

Q: A security group must allow public HTTP access but no other unrestricted TCP ports. Which Config rule setup fits this requirement?

A: Use VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS and specify TCP port 80 as the authorized TCP port. Other unrestricted TCP ports can then be identified as noncompliant.

Q: Which AWS service detects that a security group violates the authorized-port requirement?

A: AWS Config evaluates the security group against the managed Config rule and reports compliance or noncompliance.

Q: Which AWS service performs the corrective action after AWS Config identifies a noncompliant resource?

A: AWS Systems Manager Automation performs the remediation through the configured runbook.

Q: Which runbook is used in this lesson to disable public access for a security group?

A: AWS-DisablePublicAccessForSecurityGroup is the remediation Automation runbook.

Q: What resource identifier is supplied to the security-group remediation runbook?

A: The affected security group’s group ID is supplied as the resource identifier.

Q: What does 0.0.0.0/0 represent in this remediation configuration?

A: It represents unrestricted IPv4 access from any source address and is supplied as the IP address to block.

Q: Why is an Automation assume IAM role required?

A: Systems Manager Automation uses the role to obtain permission to execute the remediation actions against the target resource.

Q: Which EC2 permission is central to removing the unwanted inbound rules in this lesson?

A: ec2:RevokeSecurityGroupIngress allows the remediation to revoke security group ingress rules.

Q: When should you choose Config remediation with SSM Automation instead of only monitoring with Config?

A: Use remediation when the organization wants an automated corrective action after a compliance violation. Use monitoring alone when changes require review or may have application impact.

Q: Why might an ICMP rule remain after remediation configured around authorized TCP ports?

A: ICMP is a different traffic type from TCP, so a TCP-port authorization configuration does not necessarily evaluate or remove ICMP access.

Q: What is the operational difference between re-evaluating a Config rule and remediating a finding?

A: Re-evaluation refreshes the compliance assessment; remediation invokes the Automation action that changes the resource.

Q: What should you check if the remediation action is queued but the security group has not changed yet?

A: Allow time for the Automation execution, refresh the security group view, and inspect the execution and resulting ingress rules rather than assuming immediate completion.

Q: Why should the remediation result be validated directly in EC2?

A: The actual security group rules confirm what access remains. The lesson demonstrated that observed changes may not match every expected port, so direct inspection is important.

Q: What cleanup is appropriate after a temporary lab test?

A: Remove the remediation action and delete the temporary Config rule when it is no longer needed, so the test configuration does not continue enforcing changes.

Practice Questions

Question 1

A company wants public web access on TCP port 80 but wants AWS to flag security groups that also permit unrestricted SSH and RDP. Which configuration best matches the requirement?

A. Create an SSM Automation document that allows every TCP port
B. Configure VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS with TCP port 80 as the authorized port
C. Configure a Config rule with no authorized ports
D. Use CloudTrail to revoke security group ingress

Correct answer: B

Explanation: The managed Config rule evaluates unrestricted security group access against authorized TCP or UDP port parameters. Setting TCP port 80 as authorized allows the required web traffic while identifying other unrestricted ports.

Question 2

AWS Config has identified a noncompliant security group. The operations team wants the unwanted public ingress rule removed automatically. What should they configure?

A. An AWS Config remediation action using AWS-DisablePublicAccessForSecurityGroup
B. A CloudFormation stack policy with no IAM role
C. A CloudWatch alarm that changes the security group directly
D. An IAM access key embedded in the Config rule

Correct answer: A

Explanation: The lesson uses the AWS-DisablePublicAccessForSecurityGroup Systems Manager Automation runbook as the Config remediation action.

Question 3

A remediation action is configured, but Automation fails because it cannot change the target security group. Which issue is the most relevant to investigate first?

A. Whether the security group has a name longer than 20 characters
B. Whether the Automation assume role ARN is correct and the role permits revoking ingress
C. Whether TCP port 80 is blocked by the operating system
D. Whether the Config rule has an UDP port listed

Correct answer: B

Explanation: Systems Manager Automation needs the correct assume role, and the role must include the permissions required for the remediation, including ec2:RevokeSecurityGroupIngress.

Question 4

After remediation, SSH and RDP rules from 0.0.0.0/0 are gone, but an ICMP rule remains. What is the best interpretation?

A. The remediation necessarily failed completely
B. ICMP is always treated as TCP port 80
C. The configured TCP-port evaluation does not necessarily cover ICMP
D. 0.0.0.0/0 means only local access for ICMP

Correct answer: C

Explanation: The lesson notes that ICMP was not removed because the configuration was looking for TCP behavior. Traffic types must be evaluated according to the rule’s supported parameters.

Question 5

An engineer manually re-evaluates the Config rule and immediately expects every unauthorized ingress rule to disappear. What is the mistake?

A. Re-evaluation only assesses compliance; remediation must also be invoked
B. Config rules automatically delete all EC2 security groups
C. Re-evaluation changes the authorized port to 80
D. Security groups cannot be evaluated by AWS Config

Correct answer: A

Explanation: Re-evaluation discovers or refreshes the noncompliant state. The separate remediation action must be selected or otherwise triggered to invoke SSM Automation.

WordPress Metadata

Suggested Slug:
aws-config-ssm-automation-security-group-remediation

Meta Description:
Learn how to use AWS Config and Systems Manager Automation to detect and remediate unrestricted security group access while allowing authorized web traffic on TCP port 80.

Tags:
AWS Config, AWS Systems Manager, SSM Automation, EC2 security groups, security group remediation, AWS IAM, CloudOps, compliance monitoring, AWS security, SOA-C03