Not restricting ingress allows connections from the public internet on any port and host, significantly increasing the extent of a compromise.

Remediation

• Restrict CIDR to known range
• Restrict port to white listed set of ports.
• See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule#cidr_block

Metadata

• Severity: critical
• Slug: vpc-unrestricted-ingress

CWEs

• 284: Improper Access Control

OWASP

• A05:2021: Security Misconfiguration