Skip to main content

📝 AWS VPC Subnet Map Public IP On Launch is enabled 🟢

  • Contextual name: 📝 Subnet Map Public IP On Launch is enabled 🟢
  • ID: /ce/ca/aws/vpc/disable-subnet-map-public-ip-on-launch
  • Located in: 📁 AWS VPC

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Logic​

Description​

Open File

Description​

This policy checks whether an AWS VPC Subnet is configured to automatically assign public IPv4 addresses to instances launched within it.

Rationale​

Public IP assignment should be an intentional and controlled action. When the auto-assign public IP setting is enabled at the subnet level, all instances launched into the subnet (unless explicitly overridden) automatically receive a public IP address. This can inadvertently expose resources to the internet and increase the attack surface.

Audit​

This policy flags an AWS VPC Subnet as INCOMPLIANT if Map Public IP On Launch checkbox is set to true.

Remediation​

Open File

Remediation​

From Command Line​

Disable the Auto-assign Public IPv4 Address Subnet Attribute​
aws ec2 modify-subnet-attribute \
    --subnet-id {{subnet-id}} \
    --no-map-public-ip-on-launch

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses1
💼 Cloudaware Framework → 💼 Public and Anonymous Access79
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3767
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23678
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1145
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81156
💼 FedRAMP High Security Controls → 💼 AC-21 Information Sharing (M)(H)8
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10848
💼 FedRAMP High Security Controls → 💼 SC-7(3) Access Points (M)(H)8
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)28
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)8
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)22
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)33
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)163
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)45
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)656
💼 FedRAMP Moderate Security Controls → 💼 AC-21 Information Sharing (M)(H)8
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)742
💼 FedRAMP Moderate Security Controls → 💼 SC-7(3) Access Points (M)(H)8
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)28
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events118
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events137
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained48
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties91
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected117
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected97
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected111
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage69
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15537
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control14
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement326888
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3745
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102349
💼 NIST SP 800-53 Revision 5 → 💼 AC-21 Information Sharing28
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29450
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(3) Boundary Protection _ Access Points8
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services28
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic14
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic22
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components23
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation8
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components22
💼 PCI DSS v3.2.1 → 💼 1.3.6 Place system components that store cardholder data in an internal network zone, segregated from the DMZ and other untrusted networks.6
💼 PCI DSS v4.0.1 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.6
💼 PCI DSS v4.0 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.6