<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Cloud Network Security Groups — API Reference

## AWS Security Groups

```bash
# List all security groups
aws ec2 describe-security-groups --output table

# Find SGs with 0.0.0.0/0 ingress
aws ec2 describe-security-groups --filters "Name=ip-permission.cidr,Values=0.0.0.0/0"

# Revoke overly permissive rule
aws ec2 revoke-security-group-ingress --group-id SG_ID --protocol tcp --port 22 --cidr 0.0.0.0/0

# Add scoped rule
aws ec2 authorize-security-group-ingress --group-id SG_ID --protocol tcp --port 22 --cidr 10.0.0.0/8

# Delete unused security group
aws ec2 delete-security-group --group-id SG_ID
```

## Azure NSGs

```bash
# List NSGs
az network nsg list --output table

# List rules
az network nsg rule list --nsg-name NSG_NAME --resource-group RG --output table

# Delete permissive rule
az network nsg rule delete --nsg-name NSG_NAME --resource-group RG --name RULE_NAME

# Create scoped rule
az network nsg rule create --nsg-name NSG_NAME --resource-group RG --name AllowSSH \
  --priority 100 --access Allow --direction Inbound --protocol Tcp --destination-port-ranges 22 \
  --source-address-prefixes 10.0.0.0/8

# Enable flow logs
az network watcher flow-log create --nsg NSG_ID --storage-account STORAGE \
  --workspace WORKSPACE_ID --enabled true
```

## GCP Firewall Rules

```bash
# List firewall rules
gcloud compute firewall-rules list

# Delete permissive rule
gcloud compute firewall-rules delete RULE_NAME

# Create scoped rule
gcloud compute firewall-rules create allow-ssh-internal \
  --network=NETWORK --allow=tcp:22 --source-ranges=10.0.0.0/8 --priority=1000

# Update rule to restrict source
gcloud compute firewall-rules update RULE_NAME --source-ranges=10.0.0.0/8
```

## Dangerous Ports to Monitor

| Port | Service | Risk |
|------|---------|------|
| 22 | SSH | Remote access compromise |
| 3389 | RDP | Remote access compromise |
| 3306 | MySQL | Database exposure |
| 5432 | PostgreSQL | Database exposure |
| 1433 | MSSQL | Database exposure |
| 27017 | MongoDB | Database exposure |
| 6379 | Redis | Cache/data exposure |
| 9200 | Elasticsearch | Data exposure |
