AWS Guidelines for network scanning

Many organizations, including AWS, rely on network scanning to maintain accurate inventories of assets, verify security configurations, and identify potential vulnerabilities or software that require attention. However, threat actors can abuse networking to find and exploit vulnerabilities. The guidance in this article provides the rules of engagement to protect AWS customers from abusive network scanning. The guidance describes how to collect and manage security data so that legitimate entities can differentiate themselves from threat actors.

Objective

AWS Trust & Safety works to reduce the risks that abusive internet-wide network scanning can pose while supporting security research and risk assessment. These guidelines help customers who want to complete penetration tests on their own environments or contract authorized third parties for penetration testing. They also help guide internet-wide scanning and management of collected data.

Note: AWS Trust & Safety doesn’t endorse unauthorized penetration testing. AWS reserves the right to limit or block traffic that doesn’t comply with these guidelines.

Guidance for network scanning

To help legitimate scanners clearly differentiate themselves from threat actors, AWS offers the following guidance to help entities scan. A scanner that conforms to network scanning guidelines follows these best practices:

The scanner is observable

• Performs no actions that try to create, modify, or delete resources or data on discovered endpoints.
• Respects the integrity of targeted systems. Scans cause no degradation to system function and no change in system configuration.
• Examples of non-mutating scanning include initiation and completion of a TCP handshake and retrieval of the banner from an SSH service.

The scanner is identifiable

• Publishes sources of scanning activity to provide transparency.
• Implements a verifiable process to confirm the authenticity of scanning activities.
• Examples of identifiable scanning include:
  • Supporting reverse DNS lookups to one of your organization's public DNS zones for scanning IP addresses.
  • Publishing scanning IP address ranges that are organized by types of requests, such as service existence or vulnerability checks.
  • For HTTP scanning, you have meaningful content in user agent strings, such as names from your public DNS zones or the URL for opt-out.

The scanner is cooperative

• Limit scan rates to minimize effects on target systems. Your scans don’t measurably change the latency of service responses.
• Provide an opt-out mechanism for verified resource owners to request cessation of scanning activity.
• Honor opt-out requests within a reasonable response period.
• Examples of cooperative scanning include:
  • Limit scanning to one service transaction per second per destination service.
  • Respect site settings as expressed in robots.txt and security.txt files.

The scanner is confidential

• Maintains secure infrastructure and data handling practices, as reflected by industry certifications such as SOC2.
• Provides only authenticated and authorized access to collected scan data.
• Implements user identification and verification processes.

Benefits of conforming to network scanning guidelines

Scanners that follow these guidelines can have higher confidence in the accuracy of their scans. When scanning activities follow established protocols, the data collected provides more reliable insights into system configurations and potential areas for improvement.

AWS customers receive greater assurance that their workloads are protected from unwanted interactions. They also gain a clearer understanding of what constitutes abusive behavior versus legitimate research activities. This clarity helps organizations make informed decisions about their security posture and response protocols.

Internet users benefit from improved collective practices on security data handling. When scanning organizations adopt these practices, the overall security research community operates with higher standards. These higher standards lead to better protection for all participants in the digital environment.

Conclusion

Security works better together. AWS customers can report abusive scanning via our Report Abusive Activity form. For Category, select Network Activity, and for Type of abuse, select Port scanning or Intrusion attempts. Each report helps improve the collective protection against malicious use of security data.

The guidance outlined in this article represents a collaborative approach that balances security research needs with system protection requirements. It’s a best practice for organizations that conduct network scanning to regularly review their practices against these guidelines. These organizations can then implement improvements that enhance both the quality of their research and the protection of target systems.

For variations on network scanning, review these resources:

• Best practices for ethical web crawlers

• Penetration testing

• AWS Trust Center