Homepage

AWS network ACL allows public access Affecting VPC service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Network/ Access

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-ControlsCSA-CCMISO-27001NIST-800-53PCI-DSSSOC-2
  • Snyk IDSNYK-CC-00278
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Inbound traffic is allowed to a resource from any source instead of a restricted range, and potentially everyone can access your resource.

How to fix?

Set cidr_block attribute to specific CIDR block range only, for example 192.168.1.0/24.

Example Configuration

resource "aws_network_acl" "allowed" {
  vpc_id = "id-1234abcd"
  egress {
    protocol   = "tcp"
    rule_no    = 200
    action     = "allow"
    cidr_block = "192.168.1.0/24"
    from_port  = 443
    to_port    = 443
  }
  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "192.168.1.0/24"
    from_port  = 80
    to_port    = 80
  }
  tags = {
    Name = "main"
  }
}