Unused Network ACLs Should Be Removed

Using Console

To remediate the issue of Unused Network ACLs in AWS, you can follow these steps using the AWS Management Console:

Login to AWS Console: Go to the AWS Management Console at https://aws.amazon.com/ and log in to your AWS account.
Navigate to VPC Dashboard: From the AWS Management Console, navigate to the VPC Dashboard by clicking on ‘Services’ and then selecting ‘VPC’ under the Networking & Content Delivery section.
Identify Unused Network ACLs: In the VPC Dashboard, click on ‘Network ACLs’ in the left-hand menu. Review the list of Network ACLs to identify any that are not associated with any Subnets or not in use.
Check Associated Subnets: Click on each Network ACL to view its details and check the ‘Associated Subnets’ tab to see if it is associated with any Subnets. If a Network ACL is not associated with any Subnets, it is considered unused.
Disassociate Unused Network ACLs: To disassociate a Network ACL from a Subnet, select the unused Network ACL, click on the ‘Actions’ dropdown menu, and then choose ‘Edit associations’. Remove the association with any Subnets listed.
Delete Unused Network ACLs: Once you have disassociated the Network ACL from all Subnets, you can safely delete the unused Network ACL. Select the unused Network ACL, click on the ‘Actions’ dropdown menu, and choose ‘Delete network ACL’.
Confirm Deletion: A confirmation dialog will appear asking you to confirm the deletion of the Network ACL. Confirm the deletion to remove the unused Network ACL from your AWS account.
Verify Remediation: After deleting the unused Network ACL, verify that it has been successfully removed by checking the list of Network ACLs in the VPC Dashboard.

By following these steps, you can remediate the issue of Unused Network ACLs in AWS and ensure that your VPC resources are properly configured and secured.

Using CLI

To remediate the issue of unused Network ACLs in AWS, you can follow these steps using the AWS CLI:

List all the Network ACLs in your AWS account to identify the unused ones:

aws ec2 describe-network-acls --query 'NetworkAcls[?Associations[0]==null].NetworkAclId' --output text

Review the output of the above command to identify the unused Network ACLs that you want to remove.
Once you have identified the unused Network ACLs, you can delete them using the following command:

aws ec2 delete-network-acl --network-acl-id <network-acl-id-to-delete>

Replace <network-acl-id-to-delete> with the actual ID of the Network ACL that you want to remove.

Confirm the deletion by running the following command:

aws ec2 describe-network-acls --network-acl-ids <network-acl-id-to-delete>

Replace <network-acl-id-to-delete> with the ID of the Network ACL you just deleted. If the Network ACL is successfully deleted, this command will return an error stating that the Network ACL ID does not exist.By following these steps, you can remediate the issue of unused Network ACLs in your AWS account using the AWS CLI.

Using Python

To remediate the issue of Unused Network ACLs in AWS, you can use the Boto3 library in Python to automate the process. Here are the step-by-step instructions to remediate this issue:

Install Boto3 library:

pip install boto3

Use the following Python script to identify and remove the unused Network ACLs:

import boto3

# Create a Boto3 client for EC2
ec2_client = boto3.client('ec2')

# Get a list of all Network ACLs
response = ec2_client.describe_network_acls()

for acl in response['NetworkAcls']:
    acl_id = acl['NetworkAclId']
    
    # Check if the Network ACL is associated with any Subnet
    associations = acl['Associations']
    
    if not associations:
        # If the Network ACL is not associated with any Subnet, delete it
        ec2_client.delete_network_acl(NetworkAclId=acl_id)
        print(f"Deleted Network ACL: {acl_id}")
    else:
        print(f"Network ACL {acl_id} is in use and cannot be deleted.")

Run the Python script to identify and remove the unused Network ACLs in your AWS account.

Please ensure that you have the necessary permissions to delete Network ACLs in your AWS account before running this script. Additionally, make sure to test the script in a non-production environment before applying it to your production environment.

Using Terraform

# Example of a Network ACL that is still in use and retained
resource "aws_network_acl" "PRIMARY_NACL" {
  vpc_id = aws_vpc.MY_VPC.id

  subnet_ids = [
    aws_subnet.PUBLIC_SUBNET_1.id,
    aws_subnet.PUBLIC_SUBNET_2.id,
  ]

  tags = {
    Name = "PRIMARY_NACL"
  }
}

# NOTE:
# - Any *unused* Network ACLs should be removed from Terraform entirely:
#   - Delete their aws_network_acl "..." resource blocks from configuration.
#   - Ensure they are not associated with any subnets and are not the default
#     ACL for the VPC before doing so.
# - This is a destructive, permanent deletion of the Network ACL, matching:
#     aws ec2 delete-network-acl --network-acl-id {{asset_label}}

When you remove the unused aws_network_acl resource block(s) from your Terraform configuration and run terraform plan, verification should show those specific Network ACL resources with -/destroy actions only.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unused Network ACLs Should Be Removed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: