Skip to main content

🛡️ AWS VPC Network ACL exposes admin ports to public internet ports🟢

  • Contextual name: 🛡️ Network ACL exposes admin ports to public internet🟢
  • ID: /ce/ca/aws/vpc/network-acl-exposes-admin-ports-to-internet
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port 22 and RDP on port 3389, using TCP (6), UDP (17), or ALL (-1) protocols.

Rationale​

Public access to remote server administration ports, such as 22 and 3389, increases the attack surface and raises the risk of resource compromise.

Audit​

From Console​

Perform the following to determine if the account is configured as prescribed:

  1. Log in to the AWS Management Console at https://console.aws.amazon.com/vpc/home.

  2. In the left pane, click Network ACLs.

  3. For each network ACL, perform the following:

    • Select the network ACL.
    • Click the Inbound Rules tab.
    • Ensure no rule exists that has a port range that includes port 22, 3389, using the protocols TCP (6), UDP (17) or ALL (-1) or other remote server administration ports for your environment and has a Source of 0.0.0.0/0 and shows ALLOW.

... see more

Remediation​

Open File

Remediation​

From Console​

Perform the following:

  1. Log in to the AWS Management Console at https://console.aws.amazon.com/vpc/home.
  2. In the left pane, click Network ACLs.
  3. For each network ACL to remediate, perform the following:
    • Select the network ACL.
    • Click the Inbound Rules tab.
    • Click Edit inbound rules.
    • Either:
      • A. update the Source field to a range other than 0.0.0.0/0, or,
      • B. click Delete to remove the offending inbound rule.
    • Click Save.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 33891no data
💼 CIS AWS v1.3.0 → 💼 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports1no data
💼 CIS AWS v1.4.0 → 💼 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports1no data
💼 CIS AWS v1.5.0 → 💼 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports - Level 1 (Automated)1no data
💼 CIS AWS v2.0.0 → 💼 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports - Level 1 (Automated)1no data
💼 CIS AWS v3.0.0 → 💼 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports - Level 1 (Automated)1no data
💼 CIS AWS v4.0.0 → 💼 5.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 5.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 5.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 6.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)1no data
💼 Cloudaware Framework → 💼 Network Exposure132no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1163no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3147no data
💼 FedRAMP High Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)22no data
💼 FedRAMP High Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)31833no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10884no data
💼 FedRAMP High Security Controls → 💼 SC-7(5) Deny by Default — Allow by Exception (M)(H)19no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)37no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)45no data
💼 FedRAMP Low Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)29no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)49no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)63no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)347no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)333no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)768no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(5) Deny by Default — Allow by Exception (M)(H)19no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events180no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected187no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected160no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected184no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage123no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3763no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration746no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2(2) Baseline Configuration _ Automation Support for Accuracy and Currency22no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-7 Least Functionality923no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29493no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(5) Boundary Protection _ Deny by Default — Allow by Exception419no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components37no data
💼 PCI DSS v3.2.1 → 💼 1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic.1065no data
💼 PCI DSS v4.0.1 → 💼 1.3.1 Inbound traffic to the CDE is restricted.65no data
💼 PCI DSS v4.0.1 → 💼 1.3.2 Outbound traffic from the CDE is restricted.65no data
💼 PCI DSS v4.0 → 💼 1.3.1 Inbound traffic to the CDE is restricted.765no data
💼 PCI DSS v4.0 → 💼 1.3.2 Outbound traffic from the CDE is restricted.65no data