Network ACL blocks Internet ingress to TCP port 22 (SSH)

Check ID: ec2_networkacl_allow_ingress_tcp_port_22
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsEc2NetworkAcl

What this check verifies

VPC network ACLs are evaluated for inbound rules that permit 0.0.0.0/0 to access SSH on TCP 22 at the subnet boundary.

Risk

An ACL allowing Internet-wide SSH erodes defense in depth. Systems reachable on TCP 22 face brute-force, credential stuffing, reconnaissance, and SSH exploit attempts. Changes to routes or security groups can create direct exposure, enabling unauthorized access and lateral movement, undermining confidentiality and integrity.

Recommendation

Apply least privilege at the subnet layer:

Do not allow 0.0.0.0/0 to TCP 22
Restrict SSH to trusted sources, or avoid direct SSH via Session Manager or a bastion behind VPN

Pair tight security groups with periodic rule reviews and change control to maintain defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 replace-network-acl-entry --network-acl-id <NETWORK_ACL_ID> --ingress --rule-number <RULE_NUMBER> --protocol 6 --rule-action deny --cidr-block 0.0.0.0/0 --port-range From=22,To=22

# Deny SSH (22) from Internet on the NACL
resource "aws_network_acl_rule" "<example_resource_name>" {
  network_acl_id = "<example_resource_id>"
  rule_number    = 1
  egress         = false
  protocol       = "tcp"
  rule_action    = "deny"          # Critical: blocks SSH ingress
  cidr_block     = "0.0.0.0/0"     # Critical: Internet sources
  from_port      = 22               # Critical: SSH port
  to_port        = 22
}

# CloudFormation: Deny SSH (22) from Internet on the NACL
Resources:
  <example_resource_name>:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: <example_resource_id>
      RuleNumber: 1
      Protocol: 6
      RuleAction: deny   # Critical: blocks the traffic instead of allowing it
      Egress: false
      CidrBlock: 0.0.0.0/0  # Critical: matches Internet sources
      PortRange:
        From: 22           # Critical: SSH port
        To: 22

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_networkacl_allow_ingress_tcp_port_22. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires