wiz-network-remediation

Wiz Network Exposure Remediation

Overview

Wiz identifies network exposure risks like overly permissive security groups, lack of encryption in transit, and unprotected load balancers. This skill provides remediation patterns for network hardening.

Security Groups

Remove Unrestricted Ingress

Finding: Security group allows ingress from 0.0.0.0/0

Terraform Fix:

# Bad: Open to entire internet
resource "aws_security_group_rule" "remove_public_ssh" {
  # DO NOT create this rule
  # type              = "ingress"
  # from_port         = 22
  # to_port           = 22
  # protocol          = "tcp"
  # cidr_blocks       = ["0.0.0.0/0"]
  # security_group_id = aws_security_group.example.id
}

# Good: Restrict to corporate network
resource "aws_security_group_rule" "ssh_corporate" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["203.0.113.0/24"]  # Office VPN
  security_group_id = aws_security_group.example.id
  description       = "SSH from corporate network"
}

# Alternative: Use security group reference
resource "aws_security_group_rule" "ssh_bastion" {
  type                     = "ingress"
  from_port                = 22
  to_port                  = 22
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.bastion.id
  security_group_id        = aws_security_group.app.id
  description              = "SSH from bastion only"
}

Restrict Egress

Finding: Security group allows unrestricted egress

Terraform Fix:

# Default egress allows all (0.0.0.0/0)
# Restrict to required destinations

resource "aws_security_group" "restricted" {
  name        = "restricted-sg"
  description = "Only allow required outbound traffic"

  # Remove default allow-all egress
  revoke_rules_on_delete = true
}

# Allow only required outbound traffic
resource "aws_security_group_rule" "https_external" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.restricted.id
  description       = "HTTPS to internet"
}

resource "aws_security_group_rule" "dns" {
  type              = "egress"
  from_port         = 53
  to_port           = 53
  protocol          = "udp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.restricted.id
  description       = "DNS resolution"
}

resource "aws_security_group_rule" "internal_app" {
  type                     = "egress"
  from_port                = 5432
  to_port                  = 5432
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.database.id
  security_group_id        = aws_security_group.restricted.id
  description              = "PostgreSQL to database"
}

Network ACLs

Block Known Malicious IPs

Finding: No network segmentation or malicious IP blocking

Terraform Fix:

resource "aws_network_acl_rule" "block_malicious" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 10
  protocol       = "-1"  # All protocols
  rule_action    = "deny"
  cidr_block     = "203.0.113.50/32"  # Known malicious IP
}

# Allow legitimate traffic
resource "aws_network_acl_rule" "allow_internal" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 100
  protocol       = "-1"
  rule_action    = "allow"
  cidr_block     = "10.0.0.0/8"  # VPC CIDR
}

resource "aws_network_acl_rule" "allow_https" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 110
  protocol       = "6"  # TCP
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 443
  to_port        = 443
}

# Deny all others
resource "aws_network_acl_rule" "deny_all" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 32767
  protocol       = "-1"
  rule_action    = "deny"
  cidr_block     = "0.0.0.0/0"
}

Web Application Firewall

AWS WAF Rules

Finding: Application is exposed to internet without WAF

Terraform Fix:

resource "aws_wafv2_web_acl" "main" {
  name  = "app-waf"
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesCommonRuleSetMetric"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "RateLimitRule"
    priority = 2

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 2000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "RateLimitRuleMetric"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "GeoBlocking"
    priority = 3

    action {
      block {}
    }

    statement {
      geo_match_statement {
        country_codes = ["CN", "RU", "KP"]  # Block specific countries
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "GeoBlockingMetric"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "app-waf-metric"
    sampled_requests_enabled   = true
  }
}

# Associate WAF with ALB
resource "aws_wafv2_web_acl_association" "alb" {
  resource_arn = aws_lb.main.arn
  web_acl_arn  = aws_wafv2_web_acl.main.arn
}

VPC Hardening

Private Subnets with NAT

Finding: Resources have public IPs and direct internet access

Terraform Fix:

resource "aws_subnet" "private" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-east-1a"

  map_public_ip_on_launch = false  # No public IPs
}

resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public.id

  depends_on = [aws_internet_gateway.main]
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  route {
    destination_cidr_block = "0.0.0.0/0"
    nat_gateway_id         = aws_nat_gateway.main.id
  }
}

resource "aws_route_table_association" "private" {
  subnet_id      = aws_subnet.private.id
  route_table_id = aws_route_table.private.id
}

VPC Endpoints (AWS Service Access)

Finding: Resources communicate with AWS services over the internet

Terraform Fix:

# S3 Gateway Endpoint (no charge)
resource "aws_vpc_endpoint" "s3" {
  vpc_id       = aws_vpc.main.id
  service_name = "com.amazonaws.us-east-1.s3"

  route_table_ids = [aws_route_table.private.id]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          "arn:aws:s3:::my-bucket",
          "arn:aws:s3:::my-bucket/*"
        ]
      }
    ]
  })
}

# Secrets Manager Interface Endpoint
resource "aws_vpc_endpoint" "secretsmanager" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.secretsmanager"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [aws_subnet.private.id]
  security_group_ids  = [aws_security_group.vpc_endpoint.id]
  private_dns_enabled = true
}

Load Balancer Hardening

Enforce HTTPS

Finding: Load balancer allows unencrypted HTTP traffic

Terraform Fix:

# HTTPS listener with strong TLS policy
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate.main.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

# Redirect HTTP to HTTPS
resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.main.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

# Enable ALB access logging
resource "aws_lb" "main" {
  access_logs {
    bucket  = aws_s3_bucket.alb_logs.id
    prefix  = "alb"
    enabled = true
  }
}

Security Group for Load Balancer

Finding: Load balancer accepts traffic from entire internet on all ports

Terraform Fix:

resource "aws_security_group" "alb" {
  name        = "alb-sg"
  description = "ALB security group"
  vpc_id      = aws_vpc.main.id
}

# Allow HTTPS from internet
resource "aws_security_group_rule" "alb_https" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.alb.id
  description       = "HTTPS from internet"
}

# Allow HTTP (for redirect only)
resource "aws_security_group_rule" "alb_http" {
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.alb.id
  description       = "HTTP for redirect"
}

# Restrict egress to backend
resource "aws_security_group_rule" "alb_to_app" {
  type                     = "egress"
  from_port                = 8080
  to_port                  = 8080
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.app.id
  security_group_id        = aws_security_group.alb.id
  description              = "To app servers"
}

Verification

After network remediation:

# Test security groups
aws ec2 describe-security-groups --query 'SecurityGroups[].IpPermissions' | \
  grep -i "0.0.0.0/0" | wc -l  # Should be 0

# Test WAF rules
aws wafv2 list-web-acls --scope REGIONAL

# Test VPC endpoints
aws ec2 describe-vpc-endpoints

# Re-scan with Wiz
wiz scan --project-id <id>

Compliance Mapping

Wiz Finding	CIS Control	Fix
SG open to 0.0.0.0/0	CIS 4.1	Restrict CIDR blocks
No WAF	CIS 1.3	Add WAF rules
HTTP not redirected	CIS 4.2	Add HTTP→HTTPS redirect
No VPC endpoints	CIS 4.3	Add endpoints for AWS services
Unrestricted egress	Custom	Implement deny-all, allow explicitly