AWS NACL allows ingress from 0.0.0.0/0 to port 22 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_232
Category - Subcategory	Public Exposure - Sensitive Ports
Provider	AWS
Severity	LOW
Framework	Terraform

Impact

Network Access Control List (NACL) is stateless and provides filtering of ingress/egress network traffic to AWS resources. We recommend that NACLs do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.

How to Fix

[source,go]

resource "aws_network_acl_rule" "example" { network_acl_id = aws_network_acl.example.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow"

• cidr_block = "0.0.0.0/0"
• cidr_block = "10.0.0.0/32" from_port = 22 to_port = 22 }

---