Security Concern Opening Up Azure VM to AWS IPs

Question

We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS external IPs. Without this, the webserver can't talk to the SIEM.

Within these AWS external IPs are huge network ranges from /10 all the way to /32. The concern from the team was, even if it's AWS external IPs, that they are opening up the VM to a such a large range.

I wanted to hear your take from a security standpoint. Even if they are AWS external IPs, is the concern justified? Why?

Answer 1

Yes, it's still a concern, although you can probably mitigate the risk by using an Elastic IP in AWS, or a VPN or similar.

It's a concern because anyone with a "valid" credit card can create an account in AWS and run whatever they want. I wouldn't be surprised to find out that many instances are taken down each day because they show evidence of malicious activity. I'm sure AWS does lots of good work to try to prevent this, but realistically there'll be too many bad actors to catch them all.

Answer 2

It depends on how much of your security strategy depends on the outer most layer of your accounts and environments. In general the public cloud is so massive you cannot effectively rely on ip whitelisting (or blacklisting).

This doesn't mean the concern is invalid, but i.m.h.o it's no longer pratical. You will need additional controls in place.

Diving into your statement of having to open port 443 to aws; This makes me think your siem is "pulling" data in. If it is more practical and easier to apply controls, you could think about hosting an agent/node in Azure which pushes the data to your SIEM.

The choice depends on your strategy and risk appetite.