Project: KICS (Provisioning / Security & Compliance)
File: 3af7f2fd-06e6-4dab-b996-2912bea19ba4.md

title: Network ACL With Unrestricted Access To SSH hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3af7f2fd-06e6-4dab-b996-2912bea19ba4 Query name: Network ACL With Unrestricted Access To SSH Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: 'SSH' (TCP:22) should not be public in AWS Network ACL<br> ```tf title="Positive test num. 1 - tf file" hl_lines="30" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awsnetworkacl" "positive1" { vpcid = awsvpc.main.id egress = [ { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ] ingress = [ { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } ] tags = { Name = "main" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="22" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awsnetworkacl" "positive2" { vpcid = awsvpc.main.id tags = { Name = "main" } } resource "awsnetworkacl_rule" "postive2" { networkaclid = awsnetworkacl.positive2.id rule_number = 100 egress = false protocol = "tcp" rule_action = "allow" from_port = 22 to_port = 22 cidr_block = "0.0.0.0/0" } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="26" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "<= 3.52.0" } } } resource "awsnetworkacl" "positive3" { vpcid = awsvpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } tags = { Name = "main" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="14" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] defaultnetworkacl_ingress = [ { "action" : "allow", "cidr_block" : "0.0.0.0/0", "from_port" : 0, "protocol" : "tcp", "rule_no" : 22, "to_port" : 0 } ] enablenatgateway = true enablevpngateway = true tags = { Terraform = "true" Environment = "dev" } } ``` </details> ```tf title="Negative test

1 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awsnetworkacl" "negative1" { vpcid = awsvpc.main.id egress = [ { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ] ingress = [ { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "10.3.0.0/18" from_port = 22 to_port = 22 } ] tags = { Name = "main" } } ``` ```tf title="Negative test num. 2 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awsnetworkacl" "negative2" { vpcid = awsvpc.main.id tags = { Name = "main" } } resource "awsnetworkacl_rule" "negative2" { networkaclid = awsnetworkacl.positive1.id rule_number = 100 egress = false protocol = "tcp" rule_action = "allow" from_port = 22 to_port = 22 cidr_block = "10.3.0.0/18" } ``` ```tf title="Negative test num. 3 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "3.52.0" } } } resource "awsnetworkacl" "negative3" { vpcid = awsvpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "10.3.0.0/18" from_port = 22 to_port = 22 } tags = { Name = "main" } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true tags = { Terraform = "true" Environment = "dev" } } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] defaultnetworkacl_ingress = [ { "action" : "allow", "cidr_block" : "0.0.0.0/0", "from_port" : 0, "protocol" : "-1", "rule_no" : 100, "to_port" : 0 }, { "action" : "allow", "cidr_block" : "10.3.0.0/18", "from_port" : 0, "protocol" : "-1", "rule_no" : 22, "to_port" : 0 } ] enablenatgateway = true enablevpngateway = true tags = { Terraform = "true" Environment = "dev" } } ``` </details>