Cloud Config:vpc-network-acl-risky-ports-check

Scenarios

When a VPC allows inbound access from all CIDR blocks (0.0.0.0/0), high-risk ports must be disabled to prevent network security threats.

Risk level

Default risk level: high.

You can change the risk level based on your business requirements when you apply this rule.

Compliance evaluation logic

If the destination IP address in a VPC inbound access control rule is set to 0.0.0.0/0 and the specified port range does not include any high-risk port, the resource is evaluated as Compliant.

Rule details

Parameter	Description
Rule Template Name	vpc-network-acl-risky-ports-check
Rule Template Identifier	vpc-network-acl-risky-ports-check
Tag	NetworkAcl
Automatic remediation	Not supported
Invoke Type	Configuration Change
Supported resource type	Network access control list (ACL) (ACS::VPC::NetworkAcl)
Input parameter	The parameter name is ports. Default values: 22 and 3389. The parameter name is protocols. Default values: tcp and udp.

Non-compliance remediation

Ensure that the specified port range does not include any high-risk port. For more information, see Create and manage a network ACL.