# Ensure no Network ACLs allow ingress from 0.0.0.0/0 to SSH port 22

- Source: https://support.icompaas.com/support/solutions/articles/62000233578-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-ssh-port-22
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

Level : 2

  

### Description: 

This check ensures that no Network Access Control Lists (NACLs) in your AWS environment allow ingress (incoming) traffic from 0.0.0.0/0 (representing all IPv4 addresses) to port 22 (SSH). Allowing such traffic without restrictions could expose your resources to unauthorized access, making them vulnerable to attacks.

### Rationale:

 Allowing unrestricted ingress to port 22 (SSH) from any source IP address (0.0.0.0/0) poses significant security risks. SSH is commonly targeted by attackers attempting brute-force attacks or exploiting vulnerabilities. Restricting access to trusted IP addresses or ranges minimizes the risk of unauthorized access to sensitive resources.

### Impact:

-   Security: Unauthorized access to EC2 instances and other resources exposed to the internet can result in data breaches, service disruptions, or system compromises.
    
-   Compliance: Failure to restrict high-risk ports may violate security standards and compliance requirements (e.g., PCI-DSS, HIPAA, SOC 2, etc.).
    
-   Service Downtime: An exposed security vulnerability could lead to service outages or security incidents that might affect the availability of your resources.
    

### Default Value:

 By default, NACLs deny all inbound traffic. However, custom NACLs or modifications to default NACLs might have rules that allow ingress from 0.0.0.0/0 to port 22.

### Pre-Requisites:

-   AWS Management Console access or AWS CLI installed with appropriate permissions to describe and modify NACL rules.
    
-   Familiarity with security best practices and high-risk ports (e.g., port 22 for SSH).
    

### **Remediation:**

### Test Plan:

#### Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the VPC dashboard.
    

     ![](https://support.icompaas.com/assets/kb/8893add312a3a0e4.png)

3.  In the left-hand menu, under SECURITY, choose Network ACLs.
    

         ![](https://support.icompaas.com/assets/kb/d910669de5b88e9e.png)

4.  Select the NACL you want to examine.
    

     ![](https://support.icompaas.com/assets/kb/eb5177bd0538cdf7.png)

5.  Choose the Inbound Rules tab.
    

       ![](https://support.icompaas.com/assets/kb/68c2845f82a3d629.png)

6.  Review the Port Range and Source columns for any rules that allow ingress to port 22 from 0.0.0.0/0.
    

    ![](https://support.icompaas.com/assets/kb/566d2e96636aebf1.png)

7.  If such a rule exists, it should be modified or removed.
    

    ![](https://support.icompaas.com/assets/kb/7c949ae4714699a0.png)

#### Using AWS CLI:

Run the following command to describe the NACLs:

aws ec2 describe-network-acls --query 'NetworkAcls\[\*\].Entries\[?PortRange.From==\`22\`\].{RuleNumber:RuleNumber,Protocol:Protocol,CidrBlock:CidrBlock}'

1.  Review the output for any entries that allow ingress to port 22 from 0.0.0.0/0.
    
2.  If such entries exist, they should be modified or removed.
    

### Implementation Plan:

#### Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the VPC dashboard.
    

  ![](https://support.icompaas.com/assets/kb/ff1fedfc63588c47.png)

3.  In the left-hand menu, under SECURITY, choose Network ACLs.
    

        ![](https://support.icompaas.com/assets/kb/dc1afc0b0379f6a8.png)

4.  Select the NACL you want to modify.
    

       ![](https://support.icompaas.com/assets/kb/28c2fdf12be4c80c.png)

5.  Choose the Inbound Rules tab.
    

   ![](https://support.icompaas.com/assets/kb/bced588f4ae0044a.png)

6.  Click Edit inbound rules.
    

    ![](https://support.icompaas.com/assets/kb/96125af33a31bb36.png)

7.  Locate any rule that allows ingress from 0.0.0.0/0 to port 22.
    

  ![](https://support.icompaas.com/assets/kb/62903de5b2df198d.png)

8.  Select the rule and click Delete.
    

   ![](https://support.icompaas.com/assets/kb/9a2b3518607354c5.png)

9.  Click Save changes.
    

  ![](https://support.icompaas.com/assets/kb/b261cd187e3203f1.png)

#### Using AWS CLI:

Run the following command to revoke the ingress rule allowing access to port 22 from 0.0.0.0/0:

aws ec2 revoke-network-acl-ingress --network-acl-id <nacl-id> --rule-number <rule-number> --protocol tcp --port-range From=22,To=22 --cidr-block 0.0.0.0/0

1.  Replace <nacl-id> with your NACL ID and <rule-number> with the rule number of the ingress rule to be revoked.
    

### Backout Plan: 

#### **Using AWS Management Console:**

1.  Sign In:
    
    -   Access the AWS Management Console.
        
2.  Navigate to Network ACLs:
    
    -   Go to VPC > Network ACLs.
        
3.  Identify Modified NACLs:
    
    -   Locate the NACL where ingress rules for port 22 were restricted.
        
4.  Add a Rule for Unrestricted Ingress:
    
    -   Edit the inbound rules and add a rule to allow unrestricted ingress for port 22:
        
        -   Protocol: TCP
            
        -   Port Range: 22
            
        -   Source: 0.0.0.0/0
            
        -   Rule Action: Allow
            
5.  Confirm and Save Changes:
    
    -   Apply the changes and ensure the rule is active.
        
6.  Validate Functionality:
    
    -   Test SSH connectivity to ensure access has been restored.
        

#### **Using AWS CLI:**

1.  **Identify the Network ACL:**
    

**Describe the NACLs and check for changes:**

**aws ec2 describe-network-acls
Add a Rule to Allow Unrestricted Ingress:
aws ec2 create-network-acl-entry \\
--network-acl-id <network-acl-id> \\
--rule-number <rule-number> \\
--protocol tcp \\
--port-range From=22,To=22 \\
--cidr-block 0.0.0.0/0 \\
--rule-action allow \\
--ingress**

2.  **Validate the Changes:**
    
    -   **Recheck the rules to confirm the new entry:**
        
        **aws ec2 describe-network-acls**
        

### References:

-   [Control subnet traffic with network access control lists](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.