🛡️ AWS VPC Route Table for VPC Peering does not follow the least privilege principle🟢⚪
- Contextual name: 🛡️ Route Table for VPC Peering does not follow the least privilege principle🟢⚪
- ID:
/ce/ca/aws/vpc/route-table-for-vpc-peering-least-privilege - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Description
Description
Once a VPC peering connection is established, routing tables must be updated to enable connectivity between the peered VPCs. These routes can be as specific as needed, even peering a VPC to a single host on the other side of the connection.
Rationale
Being highly selective in peering route tables is an effective way to minimize the impact of a breach because resources outside these routes are inaccessible to the peered VPC.
Audit
Review route tables of peered VPCs to determine whether they route all subnets of each VPC and whether that is necessary for the intended purpose of peering.
From Command Line
- List all the route tables from a VPC and check if
GatewayIdis pointing to a<peering_connection_id>(e.g. pcx-1a2b3c4d) and ifDestinationCidrBlockis as specific as desired:aws ec2 describe-route-tables --filter "Name=vpc-id,Values=<vpc_id>" --query "RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[*].SubnetId}"References
... see more
Remediation
Remediation
Remove and add route table entries to ensure that only the minimum required subnets or hosts are routable for the intended peering purpose.
From Command Line
For each
{{route_table_id}}containing routes that are not compliant with your routing policy (that grant more than the desired least access), delete the non-compliant route:aws ec2 delete-route --route-table-id {{route_table_id}} --destination-cidr-block {{non_compliant_destination_CIDR}}Create a new compliant route:
aws ec2 create-route \
--route-table-id {{route_table_id}} \
--destination-cidr-block {{compliant_destination_CIDR}} \
--vpc-peering-connection-id {{peering_connection_id}}