Least-privilege cloud security group
A security group leaves SSH and the database open to the whole internet. Rewrite the ingress rules so each service is reachable only from where it should be, graded by replaying traffic and flagging anything still exposed to 0.0.0.0/0.
Scenario
A cloud VM's security group (ingress allow-list, default-deny) was set up in a hurry: SSH and the
Postgres database are open to 0.0.0.0/0. That's how databases end up on the news. Rewrite it to
least privilege.
Requirements
- HTTPS (443): open to the world (
0.0.0.0/0). - SSH (22): only from the office,
198.51.100.0/24. - Postgres (5432): only from the app subnet,
10.0.0.0/16. - Nothing sensitive (22, 5432) exposed to
0.0.0.0/0.
Rule format
Each line is an ingress allow rule (anything not allowed is denied):
allow <proto> <port[-range]> <cidr>
# e.g.
allow tcp 443 0.0.0.0/0
allow tcp 22 198.51.100.0/24
How it's graded
We replay traffic through the group and check the verdicts (office SSH allowed, internet SSH
denied, app DB allowed, internet DB denied, HTTPS public), plus a scan that fails the challenge if
any rule still exposes SSH or the database to 0.0.0.0/0.
Teaches: least-privilege network access in the cloud, the control that most data-exposure incidents come down to.
What gets checked
Your solution is verified against each of these:
- HTTPS (443) is reachable from anywhere
- SSH (22) is allowed from the office and blocked from the internet
- Postgres (5432) is reachable from the app subnet only
- Neither SSH nor the database is exposed to 0.0.0.0/0
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.