Update cfngoat.yaml

[danweavercloudsec]

No description provided.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

  AWS Security Group allows all traffic on SSH port (22)
    Resource: AWS::EC2::SecurityGroup.WebNodeSG | Checkov ID: CKV_AWS_24

How to Fix

Type: AWS::EC2::SecurityGroup
    Properties:
      ...
      SecurityGroupIngress:
      - Description: SSH Ingress
        IpProtocol: tcp
        FromPort: 22
        ToPort: 22
-       CidrIp: "0.0.0.0/0"
+       CidrIp: "10.10.10.0/24"

Description

Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.

Benchmarks

• SOC2 CC6.3.3
• PCI-DSS V3.2.1 1.2.1, 1.3, 2.2.2
• PCI-DSS V3.2 2
• HIPAA 164.312(E)(1)
• NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
• ISO27001 A.10.1.1
• CIS AWS V1.2 4.1
• CIS AWS V1.3 5.2
• FEDRAMP (MODERATE) AC-4, SC-7, SC-7(3)