Internet Gateways Should Be Attached To Authorized Virtual Private Clouds
More Info:
This rule checks if internet gateways are attached to an authorized virtual private cloud (Amazon VPC). Internet gateways provide access to the internet for instances within a VPC. The rule is marked as non-compliant if internet gateways are attached to an unauthorized VPC.Risk Level
MediumAddress
SecurityCompliance Standards
CBP,RBI_MD_ITF,RBI_UCBTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of an Internet Gateway being attached to an unauthorized Virtual Private Cloud (VPC) in AWS, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
-
Navigate to the VPC Dashboard:
- In the AWS Management Console, under the “Services” tab, select “VPC” under the Networking & Content Delivery section.
-
Identify the unauthorized VPC:
- In the VPC Dashboard, locate the Internet Gateway that is attached to the unauthorized VPC. The unauthorized VPC will be the one that should not have the Internet Gateway attached to it.
-
Detaching the Internet Gateway:
- Click on the “Internet Gateways” option in the VPC Dashboard.
- Select the Internet Gateway that is attached to the unauthorized VPC.
- Click on the “Actions” dropdown menu and select “Detach from VPC”.
- In the confirmation dialog box, click on “Detach”.
-
Attach the Internet Gateway to the authorized VPC:
- Click on the “Internet Gateways” option in the VPC Dashboard.
- Select the Internet Gateway that you just detached.
- Click on the “Actions” dropdown menu and select “Attach to VPC”.
- Select the authorized VPC from the dropdown list.
- Click on “Attach”.
-
Verify the Configuration:
- Go back to the VPC Dashboard and confirm that the Internet Gateway is now attached to the authorized VPC.
Using CLI
Using CLI
To remediate the misconfiguration of an Internet Gateway being attached to unauthorized Virtual Private Clouds in AWS using AWS CLI, follow these steps:Replace Replace
- List all the Internet Gateways in your AWS account:
- Identify the Internet Gateway that is attached to unauthorized Virtual Private Clouds.
- Detach the Internet Gateway from the unauthorized Virtual Private Cloud:
<internet-gateway-id> with the ID of the Internet Gateway and <unauthorized-vpc-id> with the ID of the unauthorized Virtual Private Cloud.- Confirm that the Internet Gateway is detached from the unauthorized Virtual Private Cloud by listing the Internet Gateway attachments:
- If needed, delete the Internet Gateway:
<internet-gateway-id> with the ID of the Internet Gateway.By following these steps, you can remediate the misconfiguration of an Internet Gateway being attached to unauthorized Virtual Private Clouds in AWS using AWS CLI.Using Python
Using Python
To remediate the misconfiguration of an Internet Gateway being attached to an unauthorized Virtual Private Cloud (VPC) in AWS using Python, you can follow these steps:
-
Install the Boto3 library: Boto3 is the AWS SDK for Python and allows you to interact with AWS services. You can install it using pip with the following command:
- Use the following Python script to detach the Internet Gateway from the unauthorized VPC and attach it to the correct VPC:
-
Replace
'YOUR_UNAUTHORIZED_VPC_ID'and'YOUR_CORRECT_VPC_ID'with the actual IDs of the unauthorized VPC and the correct VPC, respectively. - Run the Python script. This script will detach the Internet Gateway from the unauthorized VPC and attach it to the correct VPC.