Network ACL allows all traffic inbound from the internet

What it checks

Network ACL allows all traffic inbound from the internet

Where it applies

Terraform: aws_network_acl

CloudFormation: AWS::EC2::NetworkAcl

How to fix it

1. Replace the protocol = "-1" inbound entry with one entry per protocol and port range the subnet actually receives, scoped to the narrowest cidr_block that works.
2. Add an inbound entry for the ephemeral port range (1024-65535) that replies arrive on — network ACLs are stateless, so responses to outbound connections are not automatically allowed.

Frameworks

• AWS FSBP EC2.21
• SOC 2 CC6.1
• SOC 2 CC6.6
• PCI-DSS v4.0.1/1.3.1
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules