VPC network ACL allows ingress from 0.0.0.0/0 to port 3389 Affecting VPC service in AWS

Remove any invalid ingress rule from the aws_network_acl.

An ingress rule is invalid if it contains all of the following:

• A 0.0.0.0/0 in the cidr_block or ::/0 in the ipv6_cidr_block key
• A 3389 in the from_port, to_port key, or any range that includes 3389
• A allow action in the action key

Example configuration:

resource "aws_network_acl" "nacl1" {
  vpc_id = "${aws_vpc.vpc1.id}"

  subnet_ids = ["${aws_subnet.subnet1.id}"]
}

# Standalone rule
resource "aws_network_acl_rule" "rule1" {
  network_acl_id = "${aws_network_acl.nacl1.id}"
  rule_number = 10
  protocol = "tcp"
  rule_action = "allow"
  cidr_block = "192.16.0.0/24"
  from_port = 3389
  to_port = 3389
}

# Inline rule
resource "aws_network_acl" "nacl2_inline" {
  vpc_id = "${aws_vpc.vpc1.id}"

  subnet_ids = ["${aws_subnet.subnet2.id}"]

  ingress {
    protocol = "tcp"
    rule_no = 20
    action = "allow"
    cidr_block = "192.16.0.0/24"
    from_port = 3389
    to_port = 3389
  }
}

Remove any invalid AWS::EC2::NetworkAclEntry associated with the AWS::EC2::NetworkAcl.

An AWS::EC2::NetworkAclEntry is invalid if it contains all of the following:

• A 0.0.0.0/0 in the CidrBlock field
• 3389 is within the port range defined in PortRange, OR Protocol is set to -1
• RuleAction is set to allow

Alternatively, set the Properties.CidrBlock attribute to a more restrictive CIDR block, for example 192.16.0.0/24.

Example configuration:

AWSTemplateFormatVersion: 2010-09-09
Resources:
    ValidVpc03:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: '10.0.0.0/16'

  ValidVpcNacl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref ValidVpc03

  ValidVpc03NaclEntry01:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref ValidVpc03Nacl
      RuleNumber: 10
      RuleAction: allow
      Protocol: 6
      CidrBlock: "192.16.0.0/24"
      PortRange:
        From: 3389
        To: 3389