AnalysisType: policy
Filename: aws_network_acl_restricts_outbound_traffic.py
PolicyID: "AWS.NetworkACL.RestrictsOutboundTraffic"
DisplayName: "AWS Network ACL Restricts Outbound Traffic"
Enabled: false
ResourceTypes:
- AWS.EC2.NetworkACL
Tags:
- AWS
- PCI
- Exfiltration:Exfiltration Over Web Service
Reports:
PCI:
- 1.1.4
- 1.3.2
MITRE ATT&CK:
- TA0010:T1567
Severity: Low
Description: >
This policy validates that Network ACLs have some restrictions on outbound traffic.
Runbook: >
Add appropriate restrictions on outbound traffic.
Reference: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-recommended-nacl-rules.html
Tests:
- Name: Network ACL Restricts Outbound Traffic
ExpectedResult: true
Resource:
{
"Associations":
[
{
"NetworkAclAssociationId": "aclassoc-abc111222333",
"NetworkAclId": "acl-def111222333",
"SubnetId": "subnet-111222333444",
},
],
"Entries":
[
{
"CidrBlock": "0.0.0.0/0",
"Egress": true,
"IcmpTypeCode": null,
"Ipv6CidrBlock": null,
"PortRange": { "From": 1024, "To": 65535 },
"Protocol": "6",
"RuleAction": "allow",
"RuleNumber": 100,
},
{
"CidrBlock": "0.0.0.0/0",
"Egress": true,
"IcmpTypeCode": null,
"Ipv6CidrBlock": null,
"PortRange": null,
"Protocol": "-1",
"RuleAction": "deny",
"RuleNumber": 4200,
},
{
"CidrBlock": "0.0.0.0/0",
"Egress": false,
"IcmpTypeCode": null,
"Ipv6CidrBlock": null,
"PortRange": { "From": 80, "To": 80 },
"Protocol": "6",
"RuleAction": "allow",
"RuleNumber": 100,
},
],
"IsDefault": false,
"NetworkAclId": "acl-abc111222333",
"OwnerId": "123456789012",
"Tags": { "environment": "pci" },
"VpcId": "vpc-abc111222333",
}
- Name: Network ACL Does Not Restrict Outbound Traffic
ExpectedResult: false
Resource:
{
"Associations":
[
{
"NetworkAclAssociationId": "aclassoc-abc111222333",
"NetworkAclId": "acl-def111222333",
"SubnetId": "subnet-111222333444",
},
],
"Entries":
[
{
"CidrBlock": "0.0.0.0/0",
"Egress": true,
"IcmpTypeCode": null,
"Ipv6CidrBlock": null,
"PortRange": { "From": 1024, "To": 65535 },
"Protocol": "6",
"RuleAction": "allow",
"RuleNumber": 100,
},
{
"CidrBlock": "0.0.0.0/0",
"Egress": true,
"IcmpTypeCode": null,
"Ipv6CidrBlock": null,
"PortRange": null,
"Protocol": "-1",
"RuleAction": "deny",
"RuleNumber": 4200,
},
{
"CidrBlock": "0.0.0.0/0",
"Egress": true,
"IcmpTypeCode": null,
"Ipv6CidrBlock": null,
"PortRange": null,
"Protocol": "6",
"RuleAction": "allow",
"RuleNumber": 100,
},
],
"IsDefault": false,
"NetworkAclId": "acl-abc111222333",
"OwnerId": "123456789012",
"Tags": { "environment": "pci" },
"VpcId": "vpc-abc111222333",
}
# ------ paired body: aws_network_acl_restricts_outbound_traffic.py ------
# This is generic policy that checks outbound traffic rules on a Network ACL.
# It is recommended you add additional logic for your own use cases.
def policy(resource):
for entry in resource["Entries"]:
if entry["RuleAction"] == "allow" and entry["Egress"]:
# Check if entry is set to "All Ports"
if entry["PortRange"] is None:
return False
return True