Unused Network ACLs Should Be Removed
More Info:
Maintaining unused resources increases risks of misconfigurations and increases the difficulty of audits. Unused Network ACLs should therefore be discarded.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of Unused Network ACLs in AWS, you can follow these steps using the AWS Management Console:
- Login to AWS Console: Go to the AWS Management Console at https://aws.amazon.com/ and log in to your AWS account.
- Navigate to VPC Dashboard: From the AWS Management Console, navigate to the VPC Dashboard by clicking on ‘Services’ and then selecting ‘VPC’ under the Networking & Content Delivery section.
- Identify Unused Network ACLs: In the VPC Dashboard, click on ‘Network ACLs’ in the left-hand menu. Review the list of Network ACLs to identify any that are not associated with any Subnets or not in use.
- Check Associated Subnets: Click on each Network ACL to view its details and check the ‘Associated Subnets’ tab to see if it is associated with any Subnets. If a Network ACL is not associated with any Subnets, it is considered unused.
- Disassociate Unused Network ACLs: To disassociate a Network ACL from a Subnet, select the unused Network ACL, click on the ‘Actions’ dropdown menu, and then choose ‘Edit associations’. Remove the association with any Subnets listed.
- Delete Unused Network ACLs: Once you have disassociated the Network ACL from all Subnets, you can safely delete the unused Network ACL. Select the unused Network ACL, click on the ‘Actions’ dropdown menu, and choose ‘Delete network ACL’.
- Confirm Deletion: A confirmation dialog will appear asking you to confirm the deletion of the Network ACL. Confirm the deletion to remove the unused Network ACL from your AWS account.
- Verify Remediation: After deleting the unused Network ACL, verify that it has been successfully removed by checking the list of Network ACLs in the VPC Dashboard.
Using CLI
Using CLI
To remediate the issue of unused Network ACLs in AWS, you can follow these steps using the AWS CLI:
- List all the Network ACLs in your AWS account to identify the unused ones:
- Review the output of the above command to identify the unused Network ACLs that you want to remove.
- Once you have identified the unused Network ACLs, you can delete them using the following command:
<network-acl-id-to-delete> with the actual ID of the Network ACL that you want to remove.- Confirm the deletion by running the following command:
<network-acl-id-to-delete> with the ID of the Network ACL you just deleted. If the Network ACL is successfully deleted, this command will return an error stating that the Network ACL ID does not exist.By following these steps, you can remediate the issue of unused Network ACLs in your AWS account using the AWS CLI.Using Python
Using Python
To remediate the issue of Unused Network ACLs in AWS, you can use the Boto3 library in Python to automate the process. Here are the step-by-step instructions to remediate this issue:
- Install Boto3 library:
- Use the following Python script to identify and remove the unused Network ACLs:
- Run the Python script to identify and remove the unused Network ACLs in your AWS account.