Control: 15 EC2 subnets should not automatically assign public IP addresses
Description
This control checks whether the assignment of public IPs in Amazon Virtual Private Cloud (Amazon VPC) subnets have MapPublicIpOnLaunch set to FALSE. The control passes if the flag is set to FALSE.
All subnets have an attribute that determines whether a network interface created in the subnet automatically receives a public IPv4 address. Instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
Remediation
You can configure a subnet from the Amazon VPC console.
To configure a subnet to not assign public IP addresses
Open the Amazon VPC console
In the navigation pane, choose
Subnets.Select your subnet and then choose
Subnet Actions,Modify auto-assign IP settings.Clear the
Enable auto-assign public IPv4 addresscheck box and then chooseSave.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_ec2_15Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_ec2_15 --shareSQL
This control uses a named query:
vpc_subnet_auto_assign_public_ip_disabled