Standalone network ACL rule allows all traffic inbound from the internet

What it checks

Standalone network ACL rule allows all traffic inbound from the internet

Where it applies

Terraform: aws_network_acl_rule

CloudFormation: AWS::EC2::NetworkAclEntry

How to fix it

1. Change protocol from "-1" to the protocol this subnet actually receives and add from_port / to_port for its ports, then narrow cidr_block from 0.0.0.0/0 as far as the traffic allows.
2. Add a separate inbound rule for the ephemeral range (1024-65535) at a higher rule_number — network ACLs are stateless, so replies to outbound connections need their own inbound rule.

Frameworks

• AWS FSBP EC2.21
• SOC 2 CC6.1
• SOC 2 CC6.6
• PCI-DSS v4.0.1/1.3.1
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules