| name | cis-aws-foundations-6.2 |
| description | Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports |
| category | cis-networking |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","networking","nacl","vpc","ssh","rdp"] |
| cis_id | 6.2 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-6.3","cis-aws-foundations-6.4","cis-aws-foundations-6.5"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports
Description
The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port 22 and RDP on port 3389, using either the TCP (6), UDP (17), or ALL (-1) protocols.
Rationale
Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases the attack surface of resources and unnecessarily raises the risk of resource compromise.
Impact
None specified.
Audit Procedure
Using AWS Console
- Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home.
- In the left pane, click
Network ACLs.
- For each network ACL, check whether it is associated with one or more subnets.
- If it is associated, proceed to Step 5.
- If it is not associated, you may still review the rules, but note it has no effect until attached.
- Select the network ACL.
- Click the Inbound Rules tab.
- Ensure that no rule exists which has a port range that includes port 22 or 3389, uses the protocols TCP (6), UDP (17), or ALL (-1), or other remote server administration ports for your environment, has a Source of 0.0.0.0/0, and shows ALLOW.
Note:
- A port value of ALL or a port range such as 0-3389 includes port 22, 3389, and potentially other remote server administration ports.
- An effective ruleset that explicitly DENIES access to these ports (e.g., a DENY rule for ports 22 and 3389 from 0.0.0.0/0 placed before a broader ALLOW rule such as ANY/ANY) is considered acceptable, as NACLs are evaluated in order and the DENY rule will take precedence.
Using AWS CLI
The CLI command to see all the matching ACLs bound to a subnet is:
aws ec2 describe-network-acls --filters "Name=association.subnet-id,Values=*" --query 'NetworkAcls[].{ACL_ID:NetworkAclId, Subnet_ID:Associations[].SubnetId, Rules:Entries[?Egress==true && RuleAction==allow && (CidrBlock==0.0.0.0/0 || Ipv6CidrBlock==::/0)].{RuleNumber:RuleNumber, Action:RuleAction, Protocol:Protocol, CidrBlock:CidrBlock, Ipv6CidrBlock:Ipv6CidrBlock, PortRange:PortRange}}' --output table
For unattached ACLs:
aws ec2 describe-network-acls --query 'NetworkAcls[].{ACL_ID:NetworkAclId, Subnet_ID:Associations[].SubnetId, Rules:Entries[?Egress==true && RuleAction==allow && (CidrBlock==0.0.0.0/0 || Ipv6CidrBlock==::/0)].{RuleNumber:RuleNumber, Action:RuleAction, Protocol:Protocol, CidrBlock:CidrBlock, Ipv6CidrBlock:Ipv6CidrBlock, PortRange:PortRange}}' --output table
