Network ACL does not allow ingress from the Internet to TCP port 22 (SSH)
ec2_networkacl_allow_ingress_tcp_port_22
VPC network ACLs are evaluated for inbound rules that permit 0.0.0.0/0 to access SSH on TCP 22 at the subnet boundary.
Risk
An ACL allowing Internet-wide SSH erodes defense in depth. Systems reachable on TCP 22 face brute-force, credential stuffing, reconnaissance, and SSH exploit attempts.
Changes to routes or security groups can create direct exposure, enabling unauthorized access and lateral movement, undermining confidentiality and integrity.
prowler aws --checks ec2_networkacl_allow_ingress_tcp_port_22
Recommendation
Apply least privilege at the subnet layer:
- Do not allow
0.0.0.0/0toTCP 22 - Restrict SSH to trusted sources, or avoid direct SSH via Session Manager or a bastion behind VPN
Pair tight security groups with periodic rule reviews and change control to maintain defense in depth.
Remediation
aws ec2 replace-network-acl-entry --network-acl-id <NETWORK_ACL_ID> --ingress --rule-number <RULE_NUMBER> --protocol 6 --rule-action deny --cidr-block 0.0.0.0/0 --port-range From=22,To=22
- In AWS Console, go to VPC > Network ACLs
- Select <example_resource_name> and open the Inbound rules tab
- Delete any rule that ALLOWS TCP port 22 from 0.0.0.0/0 or ::/0
- Save changes
- If you cannot delete it, edit the rule and set Action to Deny for TCP port 22 with source 0.0.0.0/0 (and ::/0 if present), then save
Source Code
Resource Type
AwsEc2NetworkAcl