T09 · Insecure Skill Coding Practices
- Location
SKILL.md:362- Finding
Unrestricted Outbound Network Access in Terraform Security Group Template
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 362-367
Vulnerability Type: Overly permissive network security configuration
Risk Level: MediumThe example Terraform template defines unrestricted IPv4 egress for the application security group:
hcl egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] }Technical Analysis
The rule permits application instances to initiate connections to every IPv4 destination over every protocol and port. This conflicts with the document's stated least-privilege objective.
Because this code is presented as generated infrastructure output, users may deploy it without tightening the rule. Unrestricted egress is not generally an initial compromise by itself, but it removes an important containment boundary after an application, dependency, or instance is compromised.
Attack Path
- A user adopts the example Terraform configuration in a cloud environment.
- Terraform creates the application security group with unrestricted outbound access.
- An attacker compromises an attached application instance through a separate application, credential, or dependency vulnerability.
- The compromised instance connects to an arbitrary attacker-controlled host using any protocol or port.
- The attacker uses that channel to retrieve additional payloads, establish command-and-control communication, or exfiltrate accessible data.
Impact Assessment
The rule does not directly grant cloud privileges, but it allows any process running on an attached resource to communicate with arbitrary external systems. Following a workload compromise, this can facilitate data exfiltration, malware retrieval, command-and-control traffic, and access to unauthorized external services.
The scope includes every workload associated with this security group. The ultimate data and privileges exposed depend on the instance role, locally ...[truncated 97 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace unrestricted egress with rules limited to the protocols, ports, and destinations required by the application.
- Use AWS-managed prefix lists, organization-controlled prefix lists, specific CIDR ranges, or security-group references where appropriate.
- Route necessary internet access through a controlled egress proxy, firewall, or NAT path with logging and filtering.
- Prefer VPC endpoints for supported AWS services so traffic does not require unrestricted internet access.
- Document each permitted destination and its operational justification.
- Add policy-as-code checks using tools such as Checkov, tfsec, or Open Policy Agent to reject unrestricted egress unless an explicit exception is approved.
- Enable VPC Flow Logs and alerts for unusual outbound destinations or traffic patterns.