feat(AWS) allow ingress to any port for user defined network interface types

[kagahd]

Copied from the slack channel:

prowler has checks to ensure that there are no AWS Security Groups without ingress filtering (0.0.0.0/0) being used.
In prowler v2 it's extra74 and in prowler v3/v4 it's ec2_securitygroup_allow_ingress_from_internet_to_any_port.
However, there are cases where an ec2 instance requires access from or to external IP addresses. In these cases, to reduce the attack surface, it's best practice to put a load balancer or an API gateway in front of the ec2 instance whereas the ec2 instance must only allow traffic from/to its load balancer. Furthermore, the load balancer or API gateway should allow traffic only on the IP range, the protocols and the ports that are required for the application running on the ec2 instance.
Additionally, separation of concerns should be applied: each resource or resource group should have its own security group. Especially if the security group allows public access, it must only be attached to the load balancer or an API gateway.
Additionally, security groups may get automatically created by AWS for VPC endpoints as for example GuardDuty. These, by AWS automatically created, security groups allow all in- and outbound traffic (0.0.0.0/0) but since their endpoint is on AWS side, we consider it's not our responsibility to protect AWS resources.
Therefore, we didn't want to get alarmed by the prowler checks in these special cases.
To achieve this goal, we patched prowler v2 check extra74 as follows, the changed code line is:
SG_NO_INGRESS_FILTER=$($AWSCLI ec2 describe-network-interfaces $PROFILE_OPT --region $regx --filters "Name=group-id,Values=$SG_ID" --query "length(NetworkInterfaces[?Attachment.InstanceOwnerId != 'amazon-elb' && InterfaceType != 'api_gateway_managed' && InterfaceType != 'vpc_endpoint'])" --output text)
instead of:
SG_NO_INGRESS_FILTER=$($AWSCLI ec2 describe-network-interfaces $PROFILE_OPT --region $regx --filters "Name=group-id,Values=$SG_ID" --query "length(NetworkInterfaces)" --output text)
How do you deal with these special cases?
Do you think it's worth to extend prowler v3/v4 check ec2_securitygroup_allow_ingress_from_internet_to_any_port or to write a new one to cover these special cases?

Do you think that you could implement my suggestions in this check or a even create a new check?
Or do you prefer that my company uses a customized check?
I think such a check would make sense to many users of prowler so I would suggest to have such a check in the official prowler distribution. What do you think?

Copied from PR #3982:

@jfagoagas wrote:

What if we include these filters in the EC2 service while retrieving security groups? We can store the InstanceOwnerId of the network interface and the InterfaceType and include a config argument to check it or not. What do you think?

[kagahd]

Hi @jfagoagas,

I created a branch allow_ingress_for_eni_types in my forked repo to implement your idea for the issue.
Two unit tests in Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port are still failing (their status is PASS instead of FAIL) because their open-to-the-internet security group does not have a network interface attached, so the check let them correctly PASS. Once a network interface attached that is not allowed, these both unit tests should correctly FAIL.
What do you think of this?

[kagahd]

Hi @jfagoagas,
as you can see in the code, apart from the config, everything was already there. I just need to adapt the check to read the config and behave accordingly.
Could you please show me how the unit tests have to be adapted so that their security group is attached to a network interface?

[jfagoagas]

I think the better would be to create a PR from that branch and continue working there. What do you think?

[kagahd]

What do you think?

That makes sense, so I opened this PR #4094