CreateNetworkAclEntry
AWS
CreateNetworkAclEntry
Event
Adds an allow or deny rule to a Network ACL, controlling traffic entering or leaving a specific VPC subnet.
Security Context
- Modifying network security controls can open unauthorized access paths while removing evidence of the original restrictive configuration.
Log Source
CloudTrail
Sample Event
Adversarial. Draco adds a NACL allow-rule (low rule number 90, ingress, all-protocols, source 203.0.113.66/32) to the OCCAMY pipeline subnet’s network ACL. NACLs are evaluated lowest-rule-number-first, so a rule at 90 overrides any restrictive rule at 100+. This is the subnet-level analog to the security-group ingress modification (event 12) — a defense-in-depth bypass.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T23:46:09Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateNetworkAclEntry", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "networkAclId": "acl-0666nacl0entry666", "ruleNumber": 90, "protocol": "-1", "ruleAction": "allow", "egress": false, "cidrBlock": "203.0.113.66/32" }, "responseElements": { "requestId": "90000000-0000-4000-8000-000010010010", "_return": true }, "requestID": "90000000-0000-4000-8000-000010010010", "eventID": "90000000-0000-4000-8000-000010010011", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Defense Impairment
Techniques:
- T1686.001 — Cloud Firewall — Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.