Accuracy of exposed_internet flag on EC2 Instances

[khourybrazil]

If an instance doesn't have an EIP assigned to it, has an ENI attached to a private subnet in a VPC and has 0.0.0.0/0 permitted by a security group would it still be flagged with exposed_internet? It probably is worth flagging but maybe with something that conveyed the excessive permissiveness instead?

[achantavy]

If an instance doesn't have an EIP assigned to it, has an ENI attached to a private subnet in a VPC and has 0.0.0.0/0 permitted by a security group would it still be flagged with exposed_internet?

Yes, see here. The security group allows the 0.0.0.0/0 subnet via an IP Permission.

It probably is worth flagging but maybe with something that conveyed the excessive permissiveness instead?

Let me see if I understand your suggestion correctly: there are cases with EC2 instances that have no public IP addresses and no public DNS names, but Cartography still marks them as exposed_internet = True because they are part of an EC2 security group that allows traffic from 0.0.0.0/0. The instance itself would be exposed to the internet if it had a public DNS name and a public IP but since it doesn't, we might want a more nuanced way to label this scenario than just marking it with exposed_internet = True.

Is that about right?

We'll think on this, thanks for pointing it out.

[achantavy]

Hi @khourybrazil, talked with @sachafaust on this and we agree this is a bug.

It looks like there are 2 cases that we need to fix.

1. The EC2 instance is marked as exposed_internet=True but there is no network interface connected to it:
   match(e:EC2Instance{exposed_internet:True})-[r:RESOURCE]-(a:AWSAccount) where not (e)-[:NETWORK_INTERFACE]-(:NetworkInterface) return *

2. The EC2 instance is marked as exposed_internet=True but it does not have a publicdnsname:
   match(ni:NetworkInterface)-[r:NETWORK_INTERFACE]-(e:EC2Instance{exposed_internet:True})-[r2:RESOURCE]-(a:AWSAccount) where e.publicdnsname='' or not exists(e.publicdnsname) return *

A side note for case 2 above: e.publicdnsname gets set to the empty string by default and we might want to change that to None.

[achantavy]

@sachafaust Do we need to also take into account this case?

match(e:EC2Instance{exposed_internet:True})-[r:RESOURCE]-(a:AWSAccount) where not (e)-[:NETWORK_INTERFACE]-(:NetworkInterface) return *

[achantavy]

Scratch that, yeah the fix covers both cases (at least on our own data 😛)

[achantavy]

See https://pypi.org/project/cartography/0.2.3rc3/

[sachafaust]

@khourybrazil hope we fixed the bug you found. Tks a lot !