Network ACL blocks Internet ingress to TCP port 3389 (RDP)

Check ID: ec2_networkacl_allow_ingress_tcp_port_3389
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsEc2NetworkAcl

What this check verifies

VPC network ACLs with inbound rules allowing RDP on TCP 3389 from 0.0.0.0/0 are identified. Assessment focuses on subnet-level ACL entries that permit this traffic.

Risk

Internet-exposed RDP enables password spraying, brute force, and exploitation of RDP flaws to gain remote control. Allowing it at the subnet layer weakens defense in depth-a misconfigured security group or route can expose instances-leading to data exfiltration, privilege escalation, and ransomware, impacting confidentiality and integrity.

Recommendation

Enforce least privilege: do not allow TCP 3389 from 0.0.0.0/0 in network ACLs.

Restrict RDP to specific admin IP ranges
Prefer bastion hosts or Session Manager over direct RDP
Use private subnets and layer controls for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 delete-network-acl-entry —network-acl-id <NETWORK_ACL_ID> —ingress —rule-number <RULE_NUMBER>

# Deny inbound RDP (TCP 3389) from the Internet on an existing NACL
resource "aws_network_acl_rule" "<example_resource_name>" {
  network_acl_id = "<example_resource_id>"
  rule_number    = 1                 # Critical: lower than any allow so deny takes precedence
  egress         = false             # Ingress rule
  protocol       = "tcp"
  rule_action    = "deny"            # Critical: block the traffic
  cidr_block     = "0.0.0.0/0"       # Critical: Internet source
  from_port      = 3389              # Critical: RDP port
  to_port        = 3389
}

# CloudFormation: deny inbound RDP (TCP 3389) from the Internet on an existing NACL
Resources:
  NetworkAclDenyRDP:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: <example_resource_id>
      RuleNumber: 1                 # Critical: ensure this deny is evaluated before any allow
      Protocol: 6                   # TCP
      Egress: false                 # Ingress rule
      RuleAction: deny              # Critical: block the traffic
      CidrBlock: 0.0.0.0/0          # Critical: Internet source
      PortRange:
        From: 3389                  # Critical: RDP port
        To: 3389

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_networkacl_allow_ingress_tcp_port_3389. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires