🧠 AWS EC2 Instance without a public IP address is in a public subnet - prod.logic.yaml🟢

Contextual name: 🧠 prod.logic.yaml🟢
ID: /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
Tags:
- 🟢 Logic test success
- 🟢 Logic with extracts
- 🟢 Logic with test data

Uses

📗 AWS EC2 Instance
🔌 AWS VPC Route Table Association - object.extracts.yaml
🔌 AWS VPC Route - object.extracts.yaml
🔌 AWS EC2 Instance - object.extracts.yaml
🧪 test-data.json

Test Results 🟢

Generated at: 2025-10-31T08:20:26.659712236Z Open

Result	Id	Condition Index	Condition Text	Runtime Error

Generation Bundle

	File	MD5
Open	`/ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/policy.yaml`	`F7C926B7A86887ECDAC8FC8766F6AE1E`
Open	`/ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml`	`F6141B11A5AA836D07195B433B69112C`
Open	`/ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/test-data.json`	`15F5977FBF2522B1B6312F6B1AF7DEC5`
Open	`/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml`	`A7C7920B6078DD78806ADA0DC37D345B`
Open	`/types/CA10__CaAwsRoute__c/object.extracts.yaml`	`E4999A9B58375B79BA8254DDA1FC6534`
Open	`/types/CA10__CaAwsInstance__c/object.extracts.yaml`	`BA4E6733C7AF791FAB57658956CE24DF`

Available Commands

repo-manager policies generate FULL /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml

Content

Open File

---
# Policy identifies EC2 Instances in a public subnet without public IP address.
# If an instance doesn't have a public IP, it can't connect to the internet and should be in a private subnet
# Public subnet is a subnet that has a route to Internet Gateway

# There are 2 cases when a subnet is public.

# Case A - [EC2 Instance . VPC Subnet -> Route Table Association . Route Table -> Route]
# instance subnet has a CUSTOM Route Table with a Route to Internet Gateway.
# in this case the EC2 Instance VPC Subnet will have Route Table Association object that points to Route Table -> Route

# Case B - [EC2 Instance . VPC -> Route Table (-> Route Table Association) -> Route]
# instance subnet has a MAIN Route Table (which is denoted by Main field on Route Table Association object, and is created by default in VPCs) with a Route to Internet Gateway.
# in this case the EC2 Instance VPC Subnet will NOT have Route Table Association object and we have to find the MAIN Route Table before we check the Route
# after we get to VPC -> Route Table related list, we have to take 3 steps
# 1st step: -> Route Table Association CA10__main__c == true to slice off only the main table in 3 step
# 2nd step: -> Route CA10__gatewayId__c starts with "igw"
# 3rd step: finally we mark as INCOMPLIANT a Route Table that HAS Route Table Association CA10__main__c == true AND Route CA10__gatewayId__c starts with "igw" 
inputType: CA10__CaAwsInstance__c
testData:
  - file: test-data.json
importExtracts:
  - file: "/types/CA10__CaAwsInstance__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "Instance does not belong to a subnet"
    check:
      IS_EMPTY_LOOKUP: "CA10__vpcSubnet__r"
  - status: "INAPPLICABLE"
    currentStateMessage: "Instance has a public IP"
    check:
      NOT_EMPTY:
        arg:
          EXTRACT: "CA10__publicIpAddress__c"
# Case A: 1. INCOMPLIANT status if EC2 Instance . VPC Subnet -> Route Table Association has Route Table with a Route to Internet Gateway
  - status: "INCOMPLIANT"
    currentStateMessage: "This EC2 Instance is in a public subnet."
    remediationMessage: "Consider removing the public route or migrating the instance to a private subnet."
    check:
    # Case A: 1.1.
      RELATED_LIST_HAS: 
        status: "INCOMPLIANT"
        relationshipName: "CA10__vpcSubnet__r.CA10__routeTableAssociations__r"
# Case A: 1. COMPLIANT status if VPC Subnet -> Route Table Association DOESN'T have Route Table with a Route to Internet Gateway
  - status: "COMPLIANT"
    currentStateMessage: "This EC2 Instance is in a private subnet."
    check:
    # Case A: 1.1.
      RELATED_LIST_HAS:
        status: "COMPLIANT"
        relationshipName: "CA10__vpcSubnet__r.CA10__routeTableAssociations__r"
# Case B: 2. INCOMPLIANT status if EC2 Instance . VPC -> MAIN Route Table has a Route to Internet Gateway
  - status: "INCOMPLIANT"
    currentStateMessage: "This EC2 Instance is in a public subnet."
    remediationMessage: "Consider removing the public route or migrating the instance to a private subnet."
    check:
    # Case B: 2.1.
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__vpc__r.CA10__routeTables__r"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "This EC2 Instance is not in a private subnet."
relatedLists:
  - relationshipName: "CA10__vpcSubnet__r.CA10__routeTableAssociations__r"
    importExtracts:
      - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
    conditions:
# Case A: 1.1. INCOMPLIANT status if Route Table -> Route has Internet Gateway
      - status: "INCOMPLIANT"
        currentStateMessage: "This subnet route table has an Internet Gateway route."
        remediationMessage: "Consider removing Internet Gateway routes."
        check:
        # Case A: 1.1.1.
          RELATED_LIST_HAS:
            status: "INCOMPLIANT"
            relationshipName: "CA10__routeTable__r.CA10__routes__r"
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "This subnet is compliant"
    relatedLists:
      - relationshipName: "CA10__routeTable__r.CA10__routes__r"
        conditions:
# Case A: 1.1.1. INCOMPLIANT status if Route has Internet Gateway
          - status: "INCOMPLIANT"
            currentStateMessage: "This is an Internet Gateway route."
            remediationMessage: "Consider removing this route."
            check:
              STARTS_WITH:
                arg:
                  EXTRACT: "CA10__gatewayId__c"
                search:
                  TEXT: "igw"
        otherwise:
          status: "COMPLIANT"
          currentStateMessage: "This is not an Internet Gateway Route."
  - relationshipName: "CA10__vpc__r.CA10__routeTables__r"
    importExtracts:
      - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
      - file: "/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml"
    conditions:
# Case B: 2.1. INCOMPLIANT status if VPC -> Route Table HAS Route Table Association CA10__main__c == true AND Route CA10__gatewayId__c starts with "igw" 
      - status: "INCOMPLIANT"
        currentStateMessage: "This is a Main Route Table with an Internet Gateway route."
        remediationMessage: "Consider removing this route."
        check:
          AND:
            args:
            # Case B: 2.1.1.
              - RELATED_LIST_HAS:
                  status: "COMPLIANT"
                  relationshipName: "CA10__routeTableAssociations__r"
            # Case B: 2.1.2.
              - RELATED_LIST_HAS:
                  status: "INCOMPLIANT"
                  relationshipName: "CA10__routes__r"
    otherwise:
      status: "INAPPLICABLE"
      currentStateMessage: "Custom Route Tables or Main Route Table without Internet Gateway."
    relatedLists:
      - relationshipName: "CA10__routeTableAssociations__r"
        conditions:
# Case B: 2.1.1. COMPLAINT status if Route Table Association CA10__main__c == true
          - status: "COMPLIANT"
            currentStateMessage: "This is a Main Route Table."
            check:
              IS_EQUAL:
                left:
                  EXTRACT: "CA10__main__c"
                right:
                  BOOLEAN: true
        otherwise:
          status: "INAPPLICABLE"
          currentStateMessage: "This is not a Main Route Table."
      - relationshipName: "CA10__routes__r"
        conditions:
# Case B: 2.1.2. INCOMPLIANT status if Route CA10__gatewayId__c starts with "igw" 
          - status: "INCOMPLIANT"
            currentStateMessage: "This is an Internet Gateway route."
            remediationMessage: "Consider removing this route."
            check:
              STARTS_WITH:
                arg:
                  EXTRACT: "CA10__gatewayId__c"
                search:
                  TEXT: "igw"
        otherwise:
          status: "COMPLIANT"
          currentStateMessage: "This is not an Internet Gateway Route."

Uses​

Test Results 🟢​

Generation Bundle​

Available Commands​

Content​

Uses

Test Results 🟢

Generation Bundle

Available Commands

Content