How to deny all outbound traffic from an AWS EC2 Instance using a Security Group?

Question

I am trying to set an AWS Security Group egress rule which blocks all outbound traffic. It has been known that by default, security groups allow all outbound traffic.

I am using AWS CloudFormation and how should we define the appropriate security egress rule?

Answer 1

Even though CloudFormation does not allow an empty SecurityGroupEgress or SecurityGroupIngress properties, you can trick it by allowing allowing all outbound traffic to localhost only:

AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  InstanceSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties: 
      GroupName: block-outbound
      GroupDescription: Allow http to client host
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 127.0.0.1/32
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      VpcId: !Ref myVPC

This will achieve your aim of blocking all outbound traffic.

Answer 2

Security Groups always define ALLOW traffic. There is no concept of a DENY for security groups.

Therefore, if you wish to deny all traffic, simply have an empty Security Group.

However, please note that Security Groups are stateful. This means that, if the Inbound security group permits a connection (eg a request coming into a web server), the response will be automatically permitted to exit the server. Therefore, it is only truly blocked if both the inbound and outbound security groups are empty (depending upon your configuration).

Other options for blocking the server are a host-based firewall rule (that is, a configuration within the operating system) or the use of Network Access Control Lists (NACLs) that operate at the Subnet level. NACLs have DENY rules that can block traffic in/out of a Subnet (but not to a specific instance).

Update

It turns out that, if no Egress rules are supplied, then the default "Allow All" rule is applied to the security group.

Therefore, you need to supply a rule that does nothing, so that the default rule doesn't apply.

For example:

"InstanceSecurityGroup": {
  "Type": "AWS::EC2::SecurityGroup",
  "Properties": {
    "VpcId": {
      "Ref": "VPC"
    },
    "SecurityGroupIngress": [
      {
        "IpProtocol": "tcp",
        "FromPort": "80",
        "ToPort": "80",
        "CidrIp": "0.0.0.0/0"
      }
    ],
    "SecurityGroupEgress": [
      {
        "IpProtocol": "tcp",
        "FromPort": "1",
        "ToPort": "1",
        "CidrIp": "0.0.0.0/32"
      }
    ]
  }