Panther low experimental python

AWS VPC Default Network ACL Restricts All Traffic

This policy validates that the default Network ACL for a given AWS VPC is restricting all inbound and outbound traffic.

View Source

Detection Logic

from panther_aws_helpers import BadLookup, resource_lookup


def policy(resource):

    # pylint: disable=line-too-long
    default_id = f"arn:aws:ec2:{resource['Region']}:{resource['AccountId']}:network-acl/{resource['DefaultNetworkAclId']}"
    try:
        default_acl = resource_lookup(default_id)
    except BadLookup:
        return True
    return not default_acl["Entries"]

Field Validations

Loading…

Comments (0)

Loading comments...