Description

Detects unrestricted DNS access (port 53) in EC2 security group rules within CloudFormation templates. Allowing unrestricted DNS access could enable attackers to perform DNS tunneling attacks or exfiltrate data through DNS queries.

Detection Strategy

• Examines EC2 security group ingress and egress rules in CloudFormation templates

• Identifies rules that allow access on port 53 (DNS)

• Flags security group rules that have overly permissive source/destination ranges (like 0.0.0.0/0) for DNS traffic

• Reports violations when both unrestricted IP ranges and DNS port access are found in the same rule

Vulnerable code example

Resources:
  VulnerableSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Example of vulnerable security group
      VpcId:
        Ref: myVPC
      SecurityGroupIngress:...

✅ Secure code example

Resources:
  SecureSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Example of secure security group
      VpcId:
        Ref: myVPC
      SecurityGroupIngress:...