Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

Loose access configurations unnecessarily expose systems and broaden an organization's attack surface. Services open to interaction with the public are subjected to almost continuous scanning and probing by malicious entities.

This is especially problematic when a zero-day exploit for an exposed service is discovered and published (e.g Heartbleed). Attackers can actively pursue and search for unpatched and exposed systems to exploit.

"DbSecurity": {
  "Type": "AWS::RDS::DBSecurityGroup",
  "Properties": {
      "GroupDescription": "Ingress for Amazon RDS security group",
      "DBSecurityGroupIngress": {
          "CIDRIP": "0.0.0.0/0"
      }
  }
}

Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

By default, Amazon Redshift clusters are not publicly accessible.

Enabling public access to a cluster results in a wider attack surface for the organization.

Example 1: The following example template explicitly enables public access to an Amazon Redshift cluster.

"Resources": {
    "RDCluster": {
      "Type": "AWS::Redshift::Cluster",
      "Properties": {
        "NodeType": "ds2.xlarge",
        "ClusterType": "single-node",
        "DBName": "rdb",
        "PubliclyAccessible": true,
        "MasterUsername": "rduser",
        "MasterUserPassword": {
          "Ref": "MasterUserPassword"
        }
      }
    }
}