lacework-global-145
Network Access Control Lists (ACL) do not allow unrestricted inbound traffic
note
This policy may trigger an alert if you have completed an Agentless Workload Scanning integration for AWS using CloudFormation. See Alerts Triggering for lacework-global-87 and lacework-global-145 after Deployment for details.
Description
A Network ACL acts as a stateless, virtual firewall that controls traffic at the subnet level. The default Network ACL associated with a Virtual Private Cloud (VPC) allows all inbound and outbound traffic. For security purposes, best practices recommend restricting inbound Network ACLs.
Remediation
Log in to the AWS Management Console.
Select Services.
Select VPC.
Select Network ACLs.
Select the Network ACL to edit.
Select Edit inbound rules.
For each rule, restrict access to only the appropriate port or port range.
Select Save changes.