Loose access configurations unnecessarily expose systems and broaden an organization's attack surface. Services open to interaction with the public are subjected to almost continuous scanning and probing by malicious entities.

This is especially problematic when a zero-day exploit for an exposed service is discovered and published (e.g Heartbleed). Attackers can actively pursue and search for unpatched and exposed systems to exploit.

"DbSecurity": {
  "Type": "AWS::RDS::DBSecurityGroup",
  "Properties": {
      "GroupDescription": "Ingress for Amazon RDS security group",
      "DBSecurityGroupIngress": {
          "CIDRIP": "0.0.0.0/0"
      }
  }
}

By default, Amazon Redshift clusters are not publicly accessible.

Enabling public access to a cluster results in a wider attack surface for the organization.

Example 1: The following example template explicitly enables public access to an Amazon Redshift cluster.

"Resources": {
    "RDCluster": {
      "Type": "AWS::Redshift::Cluster",
      "Properties": {
        "NodeType": "ds2.xlarge",
        "ClusterType": "single-node",
        "DBName": "rdb",
        "PubliclyAccessible": true,
        "MasterUsername": "rduser",
        "MasterUserPassword": {
          "Ref": "MasterUserPassword"
        }
      }
    }
}

An AWS IAM Principal defines access to a resource for a user, service, or other entity. In an IAM Statement, there is a definition of an IAM Principal that allows everyone to access an S3 action.

Public access of an S3 bucket due to misconfigurations is a leading cause of data breaches.
Although S3 buckets block public access by default, any authorized user can update bucket policies or access control lists (ACLs) to allow public access. Forbid this type of update by enabling the setting of BlockPublicPolicy and BlockPublicAcls respectively under an S3 property of PublicAccessBlockConfiguration.
To also guard against any pre-existing overly-permissive bucket policies and ACLs respectively, enable the settings of RestrictPublicBuckets and IgnorePublicAcls.

Unencrypted communication channels are prone to eavesdropping and tampering.

Disabling transport security exposes the data to unauthorized access, potential theft, and tampering.

Unencrypted communication channels are prone to eavesdropping and tampering.

By default, ElastiCache replication group transport encryption is disabled. This exposes the data to unauthorized access, potential theft, and tampering.

Example 1: The following example template defines an ElastiCache replication group without transport encryption enabled.

{
    "Resources": {
        "ReplicationGroup": {
            "Properties": {
            "Engine": "redis",
            "EngineVersion": "EngineVersion",
            "ReplicasPerNodeGroup": "NumReplicas",
            "PreferredMaintenanceWindow": "sat:07:00-sat:08:00",
            "AtRestEncryptionEnabled": true,
            "CacheParameterGroupName": "CacheParameterGroup",
            "SecurityGroupIds": [
                "SecurityGroup"
            ],
            "SnapshotRetentionLimit": "SnapshotRetentionLimit",
            "CacheNodeType": "CacheNodeType",
            "CacheSubnetGroupName": "CacheSubnetGroupName",
            "NumNodeGroups": "NumShards",
            "SnapshotWindow": "00:00-03:00",
            "ReplicationGroupDescription": "AWS::StackName"
            },
            "UpdatePolicy": {
            "UseOnlineResharding": true
            },
            "DeletionPolicy": "Snapshot",
            "UpdateReplacePolicy": "Snapshot",
            "Type": "AWS::ElastiCache::ReplicationGroup"
        }
    }
}

By default, Amazon Redshift clusters do not require transport encryption. This exposes the data to unauthorized access, tampering, and potential theft.

Example 1: The following example template defines an Amazon Redshift cluster that does not enforce transport security.

{
    "Resources": {
        "RedShiftParms": {
            "Type": "AWS::Redshift::clusterParameterGroup",
            "Properties": {
                "Description": "parameter group",
                "ParameterGroupFamily": "redshift-1.0",
                "Parameters": [
                    {
                        "ParameterName": "require_ssl",
                        "ParameterValue": "false"
                    }
                ]
            }
        }
    }
}