Question

A financial services company must ensure that no network ACL in any of its 40 member accounts allows unrestricted inbound SSH (TCP port 22 from 0.0.0.0/0). The security team wants automatic detection of violations across all accounts and regions, plus automatic remediation that removes the offending rule whenever one appears. The solution must produce an auditable record of compliance status for regulators. Which approach best meets these requirements?

Accepted Answer

Deploy an AWS Config organization managed rule (via delegated administrator) that checks NACL rules for unrestricted port 22 access, and attach an SSM Automation remediation action that removes the non-compliant entry.

Answer

Enable VPC Flow Logs in every account and use a scheduled Lambda function to parse the logs for SSH traffic from the internet, then invoke an API call to delete the NACL rule.

Answer

Create an AWS WAF web ACL with a rule blocking port 22 and associate it with each VPC to prevent inbound SSH from the internet.

Answer

Use Amazon GuardDuty across the organization to detect SSH brute-force findings and trigger an EventBridge rule that modifies the security groups to deny port 22.