ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
2
* 관련 WIKI:
https://github.com/cloud-barista/cb-spider/wiki/Security-Group-Rules-and-Driver-API
3
* CSP별 제공 정보, PR 및 특이사항: 각 CSP별 Sheet 참고
4
5
* 2022.03.30. 현재
6
<CSP별 Security Group Rule 주요 규격 및 CB-Spider Rule 규격>
7
1. CB-Spider Security Group Rule 규격 (common 규격, Red field 참고)ProtocolPort RangeAWS: Source or Destination /
Alibaba: Authorization Object
8
DirectionAction
(제공: GCP, Azure, Alibaba)		Priority
(제공: GCP, Azure, Alibaba)		Target(대상:목적지정의)
(제공: GCP)		IPProtocolICMP type and code
(제공: AWS)		FromPortToPortCIDR비고
9
CB-Spiderinbound, outboundN/AN/AN/AALL (Port Range: -1)
TCP (Port Range: 1~65535)
UDP (Port Range: 1~65535)
ICMP (Port Range: -1)		N/A-1, 1~65535
ex) -1, 22, 443		-1, 1~65535
ex) -1, 22, 443		CIDR Block
ex) IPv4:
0.0.0.0/0, 0.0.0.0/8, 0.0.0.0/16, 0.0.0.0/24, 0.0.0.0/32
ex) IPv6:
::/0, ::/8, ::/16, ::/24, ::/32		* icmp: network layer => Port 지정 불필요
- icmp 예시: ping, echo, tracert 등
10
11
2. CSP별 Security Group Rule 주요 규격
12
AWSinbound, outboundN/AN/AN/AALL (Port range: ALL로 자동설정, 설정불가)
TCP (Port range: All, -1, 사용불가)
UDP (Port range: All, -1, 사용불가)
All ICMP-IPv4 (Port range: ALL로 자동설정, 설정불가)
All ICMP-IPv6 (Port range: ALL로 자동설정, 설정불가)
Custom ICMP-IPv4 (Port range: ALL로 자동설정, 설정불가)		protocol: Custom ICMP-IPv4일 경우 세부 선택 가능

ex) Echo Request, Redirect Message		ALL(API: -1), 0~65535
ex) 22, 1-65535, 7000-8000		1. CIDR Block
0.0.0.0/0, 0.0.0.0/8, 0.0.0.0/16, 0.0.0.0/24, 0.0.0.0/32,
1.2.3.4/32 (client IP)
::/0, ::/16, ::/32, ::/48, ::/64, 2001:db8:1234:1a00::/64

2. Security groups (보안그룹 ID)
3. Prefix list (접두사 목록)		* 웹콘솔: Template 제공으로 편리한 설정
* ref) https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html
* API
- "-1": all types or all codes
- ref) https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html
13
GCPingress, egressallow, deny
(deny 우선)		0-65535 (default:1000)
(lower is higher)		VPC 네트워크의 모든 인스턴스
네트워크 태그별 인스턴스
서비스 계정별 인스턴스		tcp (Port range: all, 0~65535)
tcp:80
tcp:20-22
icmp, tcp:80, tcp:443, udp:67-69 (조합설정가능)
(port 값만은 설정 불가, 숫자만 입력시: 프로토콜 번호로 해석)		1. CIDR Block
2. source tag
3. service account		* SG(firewall) 정의시 inbound(ingress), outbound(egress) 중 하나의 type으로만 설정 가능
* 대상(target) VM 범위를 설정 가능
* ref) https://cloud.google.com/vpc/docs/firewalls
14
Alibabavpc: inbound, outbound
classic: internet ingress, internet egress, internal inbound, internal outbound		Allow, Forbid
(Forbid 우선)		1-100
(lower is higher)		N/AAll (Port range: -1/-1만 사용가능)
Custom TCP (Port range: 1-65535, -1,0:사용불가)
Customized UDP (Port range: 1-65535, -1,0:사용불가)
All ICMP (IPv4) (Port range: -1/-1만 사용가능)
All ICMP (IPv6) (Port range: -1/-1만 사용가능)
All GRE (Port range: -1/-1만 사용가능)		N/A-1, 1~65535
ex) 1/22, 22/23, 443/443		1. IP addresses
2. CIDR blocks
3. Security groups		* ref) https://www.alibabacloud.com/help/en/doc-detail/25471.htm#concept-sm5-2wz-xdb
15
Azureinbound, outboundallow, deny100-4096
(lower is higher)		N/AAny
TCP
UDP
ICMP (Port range: 0~65535 컨솔 설정가능, 사용은 안될듯)
(ESP)
(AH)		N/A0~65535 (Any 사용불가)
ex) 80, 10000-10005		[source]
1. CIDR Block
2. Service Tag
3. Application security group

[destination]
1. CIDR Block
2.Service Tag
3. Application security group		* ref) https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100