Back to Checks
aws

Network ACL does not allow ingress from 0.0.0.0/0 to any port

ec2_networkacl_allow_ingress_any_port
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2NetworkAcl

VPC network ACLs with inbound entries that permit traffic from 0.0.0.0/0 to any port (any protocol) are identified at the subnet boundary.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing Internet-wide ingress at the subnet layer enables broad port scanning and unsolicited connections. Attackers can probe and exploit exposed services, risking data disclosure and tampering (confidentiality, integrity) and causing outages via floods or brute-force (availability). Any security group lapse then lacks a compensating control.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_networkacl_allow_ingress_any_port

Recommendation

Adopt a deny-by-default NACL posture: block 0.0.0.0/0 and allow only required ports from trusted CIDRs. Apply least privilege using security groups for fine-grained access, with NACLs as coarse stateless filters. Review and prune rules regularly, and employ defense in depth with monitoring and alerting.

Remediation

CLI

aws ec2 replace-network-acl-entry --network-acl-id <example_resource_id> --ingress --rule-number <RULE_NUMBER> --protocol -1 --rule-action deny --cidr-block 0.0.0.0/0

Terraform

# Deny all inbound from the Internet on the NACL
resource "aws_network_acl_rule" "<example_resource_name>" {
  network_acl_id = "<example_resource_id>"
  rule_number    = 100
  egress         = false
  protocol       = "-1"
  rule_action    = "deny"          # CRITICAL: Denies ingress
  cidr_block     = "0.0.0.0/0"      # CRITICAL: From the Internet (any IP)
}

NativeIaC

# CloudFormation: deny all inbound from the Internet on the NACL
Resources:
  NetworkAclDenyAllIngress:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: "<example_resource_id>"
      RuleNumber: 100
      Protocol: -1
      Egress: false
      RuleAction: deny       # CRITICAL: Denies ingress
      CidrBlock: 0.0.0.0/0  # CRITICAL: From the Internet (any IP)

Other

1In AWS Console, go to VPC > Network ACLs
2Select the NACL used by the affected subnet
3Open the Inbound rules tab and click Edit inbound rules
4Find any rule that allows 0.0.0.0/0 to all ports and change Action to Deny (or delete the allow-all rule)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.network_acls import check_network_acl


class ec2_networkacl_allow_ingress_any_port(Check):
    def execute(self):
        findings = []
        tcp_protocol = "-1"
        check_port = 0
        for arn, network_acl in ec2_client.network_acls.items():
            if (
                ec2_client.provider.scan_unused_services
                or network_acl.region in ec2_client.regions_with_sgs
            ):
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=network_acl
                )
                # If some entry allows it, that ACL is not securely configured
                if check_network_acl(network_acl.entries, tcp_protocol, check_port):
                    report.status = "FAIL"
                    report.status_extended = f"Network ACL {network_acl.name if network_acl.name else network_acl.id} has every port open to the Internet."
                    findings.append(report)
                else:
                    report.status = "PASS"
                    report.status_extended = f"Network ACL {network_acl.name if network_acl.name else network_acl.id} does not have every port open to the Internet."
                    findings.append(report)

        return findings

References