Network ACL does not allow ingress from the Internet to TCP port 3389 (RDP)
ec2_networkacl_allow_ingress_tcp_port_3389
VPC network ACLs with inbound rules allowing RDP on TCP 3389 from 0.0.0.0/0 are identified.
Assessment focuses on subnet-level ACL entries that permit this traffic.
Risk
Internet-exposed RDP enables password spraying, brute force, and exploitation of RDP flaws to gain remote control. Allowing it at the subnet layer weakens defense in depth-a misconfigured security group or route can expose instances-leading to data exfiltration, privilege escalation, and ransomware, impacting confidentiality and integrity.
prowler aws --checks ec2_networkacl_allow_ingress_tcp_port_3389
Recommendation
Enforce least privilege: do not allow TCP 3389 from 0.0.0.0/0 in network ACLs.
- Restrict RDP to specific admin IP ranges
- Prefer bastion hosts or Session Manager over direct RDP
- Use private subnets and layer controls for defense in depth
Remediation
aws ec2 delete-network-acl-entry --network-acl-id <NETWORK_ACL_ID> --ingress --rule-number <RULE_NUMBER>
- In the AWS Console, go to VPC > Network ACLs and select the ACL used by the affected subnet(s)
- Open the Inbound rules tab
- Find any rule allowing TCP port 3389 (RDP) from 0.0.0.0/0 or ::/0
- Select that rule and click Delete, then Save
- If you must keep broad allows, instead click Edit inbound rules and add a new rule with a lower rule number that Denies TCP 3389 from 0.0.0.0/0, then Save
Source Code
Resource Type
AwsEc2NetworkAcl