cis-aws-foundations-6.2

Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

Description

The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port 22 and RDP on port 3389, using either the TCP (6), UDP (17), or ALL (-1) protocols.

Rationale

Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases the attack surface of resources and unnecessarily raises the risk of resource compromise.

Impact

None specified.

Audit Procedure

Using AWS Console

1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
2. In the left pane, click Network ACLs.
3. For each network ACL, check whether it is associated with one or more subnets.
4. If it is associated, proceed to Step 5.
5. If it is not associated, you may still review the rules, but note it has no effect until attached.
6. Select the network ACL.
7. Click the Inbound Rules tab.
8. Ensure that no rule exists which has a port range that includes port 22 or 3389, uses the protocols TCP (6), UDP (17), or ALL (-1), or other remote server administration ports for your environment, has a Source of 0.0.0.0/0, and shows ALLOW.

Note:

• A port value of ALL or a port range such as 0-3389 includes port 22, 3389, and potentially other remote server administration ports.
• An effective ruleset that explicitly DENIES access to these ports (e.g., a DENY rule for ports 22 and 3389 from 0.0.0.0/0 placed before a broader ALLOW rule such as ANY/ANY) is considered acceptable, as NACLs are evaluated in order and the DENY rule will take precedence.

Using AWS CLI

The CLI command to see all the matching ACLs bound to a subnet is:

aws ec2 describe-network-acls --filters "Name=association.subnet-id,Values=*" --query 'NetworkAcls[].{ACL_ID:NetworkAclId, Subnet_ID:Associations[].SubnetId, Rules:Entries[?Egress==true && RuleAction==allow && (CidrBlock==0.0.0.0/0 || Ipv6CidrBlock==::/0)].{RuleNumber:RuleNumber, Action:RuleAction, Protocol:Protocol, CidrBlock:CidrBlock, Ipv6CidrBlock:Ipv6CidrBlock, PortRange:PortRange}}' --output table

For unattached ACLs:

aws ec2 describe-network-acls --query 'NetworkAcls[].{ACL_ID:NetworkAclId, Subnet_ID:Associations[].SubnetId, Rules:Entries[?Egress==true && RuleAction==allow && (CidrBlock==0.0.0.0/0 || Ipv6CidrBlock==::/0)].{RuleNumber:RuleNumber, Action:RuleAction, Protocol:Protocol, CidrBlock:CidrBlock, Ipv6CidrBlock:Ipv6CidrBlock, PortRange:PortRange}}' --output table

Expected Result

No Network ACL should have inbound rules allowing traffic from 0.0.0.0/0 to port 22 or 3389.

Remediation

Using AWS Console

1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
2. In the left pane, click Network ACLs.
3. For each network ACL that needs remediation, perform the following:
4. Select the network ACL.
5. Click the Inbound Rules tab.
6. Click Edit inbound rules.
7. Either: A) update the Source field to a range other than 0.0.0.0/0 B) click Delete to remove the offending inbound rule C) Add an explicit DENY rule for the affected ports (e.g., 22, 3389) from 0.0.0.0/0 with a lower rule number than any broader ALLOW rule
8. Click Save.

Using AWS CLI

No specific CLI remediation commands were provided in the benchmark.

Default Value

By default, NACLs start with rules that allow all inbound/outbound traffic (or deny all if custom), and administrators may configure them to allow 0.0.0.0/0. AWS does not automatically restrict ports like SSH (22) or RDP (3389); controls must be set manually.

References

1. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
2. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated