Network ACL allows all inbound traffic from the internet

What this check finds

A NACL ALLOW rule permits every protocol and port from 0.0.0.0/0 or ::/0. This is the rule AWS ships on the default NACL of every VPC, so it is expected on default NACLs and the associated security groups are the effective control there — check the IsDefault flag on the finding. On a NACL you created and attached deliberately, it means the subnet-level firewall is enforcing nothing and the whole defence rests on security groups alone.

Passing looks like: Network ACLs restrict inbound traffic.

How to fix it

If this is a custom NACL, replace the allow-all rule with rules scoped to the protocols, ports, and CIDRs the subnet actually needs. If it is the default NACL, confirm the security groups on the subnet's resources are restrictive, or attach a custom NACL.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More VPC checks

• HighNAT Gateway has zero outbound traffic for 7 days
• MediumNetwork ACL allows unrestricted ingress to SSH (22) or RDP (3389)
• MediumVPC does not have flow logs enabled
• MediumVPC peering route table allows broader CIDR than peer VPC

All VPC checks