Network ACL does not allow ingress from 0.0.0.0/0 to any port
ec2_networkacl_allow_ingress_any_port
VPC network ACLs with inbound entries that permit traffic from 0.0.0.0/0 to any port (any protocol) are identified at the subnet boundary.
Risk
Allowing Internet-wide ingress at the subnet layer enables broad port scanning and unsolicited connections. Attackers can probe and exploit exposed services, risking data disclosure and tampering (confidentiality, integrity) and causing outages via floods or brute-force (availability). Any security group lapse then lacks a compensating control.
prowler aws --checks ec2_networkacl_allow_ingress_any_port
Recommendation
Adopt a deny-by-default NACL posture: block 0.0.0.0/0 and allow only required ports from trusted CIDRs. Apply least privilege using security groups for fine-grained access, with NACLs as coarse stateless filters. Review and prune rules regularly, and employ defense in depth with monitoring and alerting.
Remediation
aws ec2 replace-network-acl-entry --network-acl-id <example_resource_id> --ingress --rule-number <RULE_NUMBER> --protocol -1 --rule-action deny --cidr-block 0.0.0.0/0
- In AWS Console, go to VPC > Network ACLs
- Select the NACL used by the affected subnet
- Open the Inbound rules tab and click Edit inbound rules
- Find any rule that allows 0.0.0.0/0 to all ports and change Action to Deny (or delete the allow-all rule)
- Save changes
Source Code
Resource Type
AwsEc2NetworkAcl