No Excessive Port Access | Vulnerability Database

An Network ACL rule allows ALL ports.

Ensure access to specific required ports is allowed, and nothing else.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Set specific allowed ports

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


AWSTemplateFormatVersion: "2010-09-09"

Description: Good example of excessive ports

Resources:
  NetworkACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
      RuleAction: allow
      VpcId: something

  Rule:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: null
      Protocol: 6
      Ref: NetworkACL
      RuleAction: allow

Set specific allowed ports

1
2
3
4
5
6
7
8


resource "aws_network_acl_rule" "good_example" {
  egress      = false
  protocol    = "tcp"
  from_port   = 22
  to_port     = 22
  rule_action = "allow"
  cidr_block  = "0.0.0.0/0"
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule#to_port