OCI Network Security Groups (NSG) has stateful security rules misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_OCI_21
Category - Subcategory	Public Exposure - Ingress Controls
Provider	ORACLE
Severity	MEDIUM
Framework	Terraform

Impact

This rule identifies the OCI Network Security Groups (NSG) security rules that have stateful ingress rules configured. It is recommended that Network Security Groups (NSG) security rules are configured with stateless ingress rules to slow the impact of a denial-of-service (DoS) attack.

How to Fix

To fix this issue, you should avoid setting the "stateless" attribute for ingress security rules to false.

The above code is secure because it sets the ingress security rule to stateless which is more secure. [source,go]

resource "oci_core_network_security_group_security_rule" "example" { ... direction = "INGRESS"

• stateless = false
• stateless = true }

---