Network ACL blocks Internet ingress to any port

Check ID: ec2_networkacl_allow_ingress_any_port
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2NetworkAcl

What this check verifies

VPC network ACLs with inbound entries that permit traffic from 0.0.0.0/0 to any port (any protocol) are identified at the subnet boundary.

Risk

Allowing Internet-wide ingress at the subnet layer enables broad port scanning and unsolicited connections. Attackers can probe and exploit exposed services, risking data disclosure and tampering (confidentiality, integrity) and causing outages via floods or brute-force (availability). Any security group lapse then lacks a compensating control.

Recommendation

Adopt a deny-by-default NACL posture: block 0.0.0.0/0 and allow only required ports from trusted CIDRs. Apply least privilege using security groups for fine-grained access, with NACLs as coarse stateless filters. Review and prune rules regularly, and employ defense in depth with monitoring and alerting.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 replace-network-acl-entry —network-acl-id <example_resource_id> —ingress —rule-number <RULE_NUMBER> —protocol -1 —rule-action deny —cidr-block 0.0.0.0/0

# Deny all inbound from the Internet on the NACL
resource "aws_network_acl_rule" "<example_resource_name>" {
  network_acl_id = "<example_resource_id>"
  rule_number    = 100
  egress         = false
  protocol       = "-1"
  rule_action    = "deny"          # CRITICAL: Denies ingress
  cidr_block     = "0.0.0.0/0"      # CRITICAL: From the Internet (any IP)
}

# CloudFormation: deny all inbound from the Internet on the NACL
Resources:
  NetworkAclDenyAllIngress:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: "<example_resource_id>"
      RuleNumber: 100
      Protocol: -1
      Egress: false
      RuleAction: deny       # CRITICAL: Denies ingress
      CidrBlock: 0.0.0.0/0  # CRITICAL: From the Internet (any IP)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_networkacl_allow_ingress_any_port. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires