(aws-ec2): custom resource to close default security group for VPCs

[dontirun]

A closeDefaultSG option on VPCs that removes all inbound and outbound traffic rules on the default SG for VPCs

Use Case

When creating a VPC the default security group allows for all inbound and outbound traffic. For many organizations who follow compliances such as NIST 800-53, it is a common practice to close the default security group, as seen in this config rule

Proposed Solution

1. add closeDefaultSG boolean option to VPC construct and/or closeDefaultSG method to IVPC
2. Retrieve vpcDefaultSecurityGroup property from VPC
3. Use a custom resource to check if default SG exists and remove all ingress and egress rules from default security group
4. (Not sure about this one) Make sure custom resource executes every time a stack update is performed

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[njlynch]

Thanks for the feature request, @dontirun .

I don't think this makes sense as a member property on [I]VPC, as that would tie it to another VPC construct and feels a bit awkward from an API perspective.

The right way to go here is likely just to have a dedicated Construct which implements the custom resource, ignoring the tie to IVPC altogether. There are some interesting bits here, especially with regard to when the custom resource runs -- if it runs before other resources in the stack, you could delete all rules, and then have another construct/resource immediately add the rules back.

This seems tied somewhat to some of the general ideas in our Defaults & Config RFC - aws/aws-cdk-rfcs#25. There's a general question of patterns here for detecting, implementing, and/or enforcing various best practices and AWS Config rules. Given that, I would actually be a bit hesitant to accept a contribution for this construct into the core CDK. It might be best suited published as a separate construct, advertised on Construct Hub, and consumable by anyone who'd like to use it.

That being said, I'm open to arguments for inclusion in the CDK itself. For now, marking this as a p2 and unassigning, as we won't be working on this ourselves any time soon.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.