Skip to main content

🛡️ AWS VPC Subnet Map Public IP On Launch is enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy checks whether an AWS VPC Subnet is configured to automatically assign public IPv4 addresses to instances launched within it.

Rationale​

Public IP assignment should be an intentional and controlled action. When the auto-assign public IP setting is enabled at the subnet level, all instances launched into the subnet (unless explicitly overridden) automatically receive a public IP address. This can inadvertently expose resources to the internet and increase the attack surface.

Audit​

This policy flags an AWS VPC Subnet as INCOMPLIANT if Map Public IP On Launch checkbox is set to true.

Remediation​

Open File

Remediation​

From Command Line​

Disable the Auto-assign Public IPv4 Address Subnet Attribute​
aws ec2 modify-subnet-attribute \
    --subnet-id {{subnet-id}} \
    --no-map-public-ip-on-launch

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses1no data
💼 Cloudaware Framework → 💼 Public and Anonymous Access106no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3772no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23789no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1152no data
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81161no data
💼 FedRAMP High Security Controls → 💼 AC-21 Information Sharing (M)(H)12no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10864no data
💼 FedRAMP High Security Controls → 💼 SC-7(3) Access Points (M)(H)12no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)35no data
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)12no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)28no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)72no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)40no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)72no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)173no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)52no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)661no data
💼 FedRAMP Moderate Security Controls → 💼 AC-21 Information Sharing (M)(H)12no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)753no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(3) Access Points (M)(H)12no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)35no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events150no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events149no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained76no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties120no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected164no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected140no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected156no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage103no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15544no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control18no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement326999no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3752no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102354no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-21 Information Sharing212no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29466no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(3) Boundary Protection _ Access Points12no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services35no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic18no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic28no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components29no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation12no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components28no data
💼 PCI DSS v3.2.1 → 💼 1.3.6 Place system components that store cardholder data in an internal network zone, segregated from the DMZ and other untrusted networks.11no data
💼 PCI DSS v4.0.1 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.11no data
💼 PCI DSS v4.0 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.11no data