EC2 instances placed in a default VPC are more likely to be publicly reachable and lack explicit network segmentation, increasing the risk of unintended exposure and lateral movement. This rule checks AWS::EC2::Instance resources and ensures Properties.SubnetId does not reference a subnet that is associated with a default VPC. Instances are flagged when their SubnetId references an AWS::EC2::Subnet whose Properties.VpcId resolves to a value or Ref name containing default. Use an explicit non-default VPC and private subnets. For example, reference a subnet in your own VPC:
Resources:DefaultVPC:Type:AWS::EC2::InstanceProperties:ImageId:"ami-79fd7eee"KeyName:"testkey"SubnetId:!Ref PublicSubnetA22PublicSubnetA22:Type:AWS::EC2::SubnetProperties:VpcId:!Ref VPCCidrBlock:10.1.10.0/24AvailabilityZone:!Select [ 0, !GetAZs ] # Obtenha o primeiro AZ na listaTags:- Key:NameValue:!Sub ${AWS::StackName}-Public-A
Non-Compliant Code Examples
Resources:DefaultVPC:Type:AWS::EC2::InstanceProperties:ImageId:"ami-79fd7eee"KeyName:"testkey"SubnetId:!Ref PublicSubnetA2PublicSubnetA2:Type:AWS::EC2::SubnetProperties:VpcId:!Ref DefaultVPCCidrBlock:10.1.10.0/24AvailabilityZone:!Select [ 0, !GetAZs ] # Obtenha o primeiro AZ na listaTags:- Key:NameValue:!Sub ${AWS::StackName}-Public-A
1
2
rulesets:- CloudFormation / AWS # Rules to enforce / AWS.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
