Merge pull request #9 from GovTechSG/feat/block-udp-22-and-3389

feat: added 3389 block for udp also (security hub complain)
GovTechSG · Dec 19, 2022 · dcf1876 · dcf1876
2 parents c851c36 + ab3531d
commit dcf1876
Showing 1 changed file with 21 additions and 0 deletions.
diff --git a/nacl.tf b/nacl.tf
@@ -57,6 +57,16 @@ resource "aws_network_acl_rule" "public_inbound_rdp_rule_deny" {
   rule_action    = "deny"
 }
 
+resource "aws_network_acl_rule" "public_inbound_rdp_rule_deny_udp" {
+  network_acl_id = aws_network_acl.public.id
+  cidr_block     = "0.0.0.0/0"
+  rule_number    = 106
+  protocol       = "udp"
+  from_port      = 3389
+  to_port        = 3389
+  rule_action    = "deny"
+}
+
 resource "aws_network_acl_rule" "public_outbound_rdp_rule_deny" {
   network_acl_id = aws_network_acl.public.id
   rule_number    = 105
@@ -167,6 +177,17 @@ resource "aws_network_acl_rule" "private_inbound_rdp_rule_deny" {
   rule_action    = "deny"
 }
 
+resource "aws_network_acl_rule" "private_inbound_rdp_rule_deny_udp" {
+  network_acl_id = aws_network_acl.private.id
+  cidr_block     = "0.0.0.0/0"
+  rule_number    = 106
+  protocol       = "udp"
+  from_port      = 3389
+  to_port        = 3389
+  rule_action    = "deny"
+}
+
+
 resource "aws_network_acl_rule" "private_outbound_rdp_rule_deny" {
   network_acl_id = aws_network_acl.private.id
   rule_number    = 105