add deny rdp 3389 to network acl
}
}
},
+ "InboundDenyRdpPrivateAppNetworkAclEntry": {
+ "Type": "AWS::EC2::NetworkAclEntry",
+ "Properties": {
+ "NetworkAclId": {
+ "Ref": "PrivateAppNetworkAcl"
+ },
+ "RuleNumber": "70",
+ "Protocol": "6",
+ "RuleAction": "deny",
+ "Egress": "false",
+ "CidrBlock": "0.0.0.0/0",
+ "PortRange": {
+ "From": "3389",
+ "To": "3389"
+ }
+ }
+ },
"OutboundPrivateAppNetworkAclEntry": {
"Type": "AWS::EC2::NetworkAclEntry",
"Properties": {
}
}
},
+ "OutboundDenyRdpPrivateAppNetworkAclEntry": {
+ "Type": "AWS::EC2::NetworkAclEntry",
+ "Properties": {
+ "NetworkAclId": {
+ "Ref": "PrivateAppNetworkAcl"
+ },
+ "RuleNumber": "80",
+ "Protocol": "6",
+ "RuleAction": "deny",
+ "Egress": "true",
+ "CidrBlock": "0.0.0.0/0",
+ "PortRange": {
+ "From": "3389",
+ "To": "3389"
+ }
+ }
+ },
"InboundHttpsPortPublicNetworkAclEntry": {
"Type": "AWS::EC2::NetworkAclEntry",
"Properties": {
}
}
},
+ "InboundEphemeralPortDenyRdpPublicNetworkAclEntry": {
+ "Type": "AWS::EC2::NetworkAclEntry",
+ "Properties": {
+ "NetworkAclId": {
+ "Ref": "PublicNetworkAcl"
+ },
+ "RuleNumber": "30",
+ "Protocol": "6",
+ "RuleAction": "deny",
+ "Egress": "false",
+ "CidrBlock": "0.0.0.0/0",
+ "PortRange": {
+ "From": "3389",
+ "To": "3389"
+ }
+ }
+ },
"OutboundHttpPublicNetworkAclEntry": {
"Type": "AWS::EC2::NetworkAclEntry",
"Properties": {
"To": "65535"
}
}
+ },
+ "OutboundEphemeralDenyRdpPublicNetworkAclEntry": {
+ "Type": "AWS::EC2::NetworkAclEntry",
+ "Properties": {
+ "NetworkAclId": {
+ "Ref": "PublicNetworkAcl"
+ },
+ "RuleNumber": "60",
+ "Protocol": "6",
+ "RuleAction": "deny",
+ "Egress": "true",
+ "CidrBlock": "0.0.0.0/0",
+ "PortRange": {
+ "From": "3389",
+ "To": "3389"
+ }
+ }
},
"PublicSubnetNetworkAclAssociation": {
"Type": "AWS::EC2::SubnetNetworkAclAssociation",
