Skip to main content

🛡️ AWS VPC Subnet auto-provisioning status🟢

Stats​

not available

Logic​

Description​

Open File

Description​

Identify AWS VPC Subnets that appear to be associated with AWS CloudFormation or AWS Service Catalog provisioning.

This policy checks for AWS-managed tag signals that can help identify a VPC subnet as associated with AWS CloudFormation or AWS Service Catalog. It does not require every subnet to have these tags, and it does not treat customer-defined tags as proof of provisioning origin.

Rationale​

AWS-managed provisioning tags can provide evidence that a VPC subnet was created by, attached to, or managed through an AWS service workflow. This allows to distinguish subnets with supported AWS-managed provisioning indicators from subnets that are not identified by this tag-based method.

Audit​

This policy classifies an AWS VPC Subnet as identified by automated provisioning evidence when the subnet has one of the following supported tag signals:

  • All AWS CloudFormation stack-level tags:
    • aws:cloudformation:logical-id
    • aws:cloudformation:stack-id
    • aws:cloudformation:stack-name
  • One of the AWS Service Catalog AutoTags:

... see more

Remediation​

Open File

Remediation​

Review the VPC subnet and confirm its creation source, owner, and expected management workflow.

If the subnet appears to be managed through AWS CloudFormation or AWS Service Catalog, validate that the associated stack or provisioned product is still the expected source of management. If the subnet was created manually or through another workflow, confirm that the ownership and lifecycle expectations are documented. Retire the subnet if it is no longer required.

policy.yaml​

Open File