Back to Checks
iac

A security group rule should not allow unrestricted ingress from any IP address.

NIF-0014
Service: nasSeverity: critical
OfficialBuilt-inVerified

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

Prowler logoProwlerprowler-provider-iac

Run this check with Prowler

Run in Prowler Cloud
Run
prowler iac --checks NIF-0014

Recommendation

Set a more restrictive cidr range

Check Code

# METADATA
# title: A security group rule should not allow unrestricted ingress from any IP address.
# description: |
#   Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
# scope: package
# schemas:
#   - input: schema["cloud"]
# related_resources:
#   - https://pfs.nifcloud.com/api/nas/AuthorizeNASSecurityGroupIngress.htm
# custom:
#   id: NIF-0014
#   long_id: nifcloud-nas-no-public-ingress-nas-sgr
#   aliases:
#     - AVD-NIF-0014
#     - no-public-ingress-nas-sgr
#     - nifcloud-nas-no-public-ingress-nas-sgr
#   provider: nifcloud
#   service: nas
#   severity: CRITICAL
#   recommended_action: Set a more restrictive cidr range
#   input:
#     selector:
#       - type: cloud
#         subtypes:
#           - service: nas
#             provider: nifcloud
#   examples: checks/cloud/nifcloud/nas/no_public_ingress_nas_sgr.yaml
package builtin.nifcloud.nas.nifcloud0014

import rego.v1

import data.lib.net

deny contains res if {
	some sg in input.nifcloud.nas.nassecuritygroups
	some c in sg.cidrs
	net.cidr_allows_all_ips(c.value)
	res := result.new("Security group rule allows unrestricted ingress from any IP address.", c)
}

References