Network ACL should not allow 0.0.0.0/0 ingress on SSH (22) or RDP (3389)
What it checks
Network ACL: an allow ingress rule opens SSH (22) or RDP (3389) to 0.0.0.0/0 at the subnet boundary.
Where it applies
Terraform: aws_network_acl
CloudFormation: AWS::EC2::NetworkAcl
How to fix it
- Restrict the NACL ingress rule's cidr_block from 0.0.0.0/0 to specific administrative CIDRs, or remove the rule and rely on SSM Session Manager.
Frameworks
- AWS FSBP EC2.21
- SOC 2 CC6.1
- SOC 2 CC6.6
- PCI-DSS v4.0.1/1.3.1
- HIPAA 164.312(a)(1)
These mappings are advisory, not an attestation of compliance.