Non-default network ACL is associated with a subnet

Check ID: ec2_networkacl_unused
Provider: AWS
Service: ec2
Severity: LOW
Categories: trust-boundaries
Resource type: AwsEc2NetworkAcl

What this check verifies

VPC network ACLs that are not associated with any subnet are considered unused. The evaluation focuses on non-default ACLs and identifies those without a current subnet association; the default network ACL is excluded.

Risk

Unused ACLs raise the risk of misassociation, unexpectedly changing subnet filtering. A permissive ACL could expose workloads (confidentiality, integrity), while an overly restrictive one could disrupt traffic (availability). Stale objects also hinder reviews and conceal drift.

Recommendation

Remove unused non-default ACLs to minimize drift. Apply least privilege and change control to ACL creation and associations. If retention is necessary, tag owner and purpose, restrict who can associate ACLs, and review regularly as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 delete-network-acl —network-acl-id <nacl_id>

# Associate the unused non-default NACL to a subnet so it's in use
resource "aws_network_acl_association" "<example_resource_name>" {
  subnet_id      = "<example_resource_id>"     # Critical: makes the subnet use this NACL
  network_acl_id = "<example_resource_id>"     # Critical: the unused non-default NACL to associate
}

# Associate the unused non-default NACL to a subnet so it's in use
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: <example_resource_id>        # Critical: makes the subnet use this NACL
      NetworkAclId: <example_resource_id>    # Critical: the unused non-default NACL to associate

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_networkacl_unused. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires