DNS Resolution To Private IP Should Be Enabled

Using Console

To remediate the misconfiguration “DNS Resolution To Private IP Should Be Enabled” for an AWS EC2 instance using the AWS console, follow these steps:

Log in to the AWS Management Console: Go to https://aws.amazon.com/ and log in to your AWS account.
Navigate to the VPC Dashboard: In the AWS Management Console, navigate to the VPC Dashboard by selecting “Services” in the top menu, searching for “VPC” in the search bar, and clicking on “VPC”.
Select Your VPC: In the VPC Dashboard, select the VPC that your EC2 instance is associated with from the list of available VPCs.
Edit VPC Peering Connection: In the VPC Dashboard, click on “Peering Connections” in the left-hand menu. Find the peering connection associated with the VPC that your EC2 instance is in and select it.
Edit Peering Connection Options: In the peering connection details, click on the “Actions” dropdown menu and select “Edit Peering Connection Options”.
Enable Accepter/Requester VPC To Private IP: In the “Edit Peering Connection Options” window, find the option for “Accepter/Requester VPC To Private IP” and enable it by checking the box next to it.
Save Changes: After enabling the “Accepter/Requester VPC To Private IP” option, click on the “Save Changes” button to apply the configuration.
Verify Configuration: Once the changes are saved, verify that the “Accepter/Requester VPC To Private IP” is now enabled for the peering connection associated with your VPC.

By following these steps, you have successfully remediated the misconfiguration “DNS Resolution To Private IP Should Be Enabled” for your AWS EC2 instance using the AWS console.

Using CLI

To remediate the misconfiguration “DNS Resolution To Private IP Should Be Enabled” for AWS EC2 using AWS CLI, you can follow these steps:

Identify the security group associated with your EC2 instance:

aws ec2 describe-instances --instance-ids <your-instance-id> --query 'Reservations[*].Instances[*].SecurityGroups[*].[GroupId]' --output text

Identify the VPC ID of your EC2 instance:

aws ec2 describe-instances --instance-ids <your-instance-id> --query 'Reservations[*].Instances[*].VpcId' --output text

Enable “Accepter/Requester VPC To Private IP” setting in the security group:
aws ec2 modify-security-group-attribute --group-id <security-group-id> --region <your-region> --vpc-id <vpc-id> --ingress <ingress-rule>
Replace <security-group-id>, <your-region>, <vpc-id>, and <ingress-rule> with the actual values. The <ingress-rule> should allow traffic from the VPC CIDR range to the private IP of the EC2 instance.

Verify the changes:

aws ec2 describe-security-groups --group-ids <security-group-id>

By following these steps, you should be able to remediate the misconfiguration “DNS Resolution To Private IP Should Be Enabled” for your AWS EC2 instance using AWS CLI.

Using Python

To remediate the misconfiguration “DNS Resolution To Private IP Should Be Enabled” for AWS EC2 using Python, you can use the AWS SDK for Python (Boto3) to modify the VPC peering connection’s configuration. Here are the step-by-step instructions to remediate this issue:

Install Boto3: If you haven’t installed Boto3, you can install it using pip:
pip install boto3

Write a Python script to modify the VPC peering connection: Use the following Python script to enable the “Accepter/Requester VPC To Private IP” option for a specific VPC peering connection in AWS EC2:

import boto3

# Initialize the EC2 client
ec2_client = boto3.client('ec2')

# Specify the VPC peering connection ID that needs to be modified
vpc_peering_connection_id = 'YOUR_VPC_PEERING_CONNECTION_ID'

# Modify the VPC peering connection to enable Accepter/Requester VPC To Private IP
response = ec2_client.modify_vpc_peering_connection(
    VpcPeeringConnectionId=vpc_peering_connection_id,
    RequesterPeeringConnectionOptions={
        'AllowDnsResolutionFromRemoteVpc': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowDnsResolutionFromRemoteVpcToLocalVpc': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowDnsResolutionFromLocalClassicLinkToRemoteVpc': False,
        'AllowDnsResolutionFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False,
        'AllowEgressFromLocalClassicLinkToRemoteVpc': False,
        'AllowEgressFromLocalVpcToRemoteClassicLink': False
    }
)

print('VPC peering connection configuration updated successfully.')

Replace 'YOUR_VPC_PEERING_CONNECTION_ID' with the actual VPC peering connection ID that you want to modify.
Run the Python script: Save the script in a file (e.g., remediate_vpc_peering_connection.py) and run it using Python:
python remediate_vpc_peering_connection.py

This script will modify the specified VPC peering connection to enable the “Accepter/Requester VPC To Private IP” option in AWS EC2.

Using Terraform

resource "aws_vpc_peering_connection" "VPC_PEERING_NAME" {
  vpc_id        = aws_vpc.REQUESTER_VPC.id   # replace with your requester VPC
  peer_vpc_id   = aws_vpc.ACCEPTER_VPC.id    # replace with your accepter VPC
  peer_owner_id = "ACCEPTER_ACCOUNT_ID"      # replace if cross-account
  auto_accept   = false                      # or true if same-account and desired

  requester {
    allow_remote_vpc_dns_resolution = true
  }

  accepter {
    allow_remote_vpc_dns_resolution = true
  }

  tags = {
    Name = "VPC_PEERING_NAME"                # replace with your peering name
  }
}

If the VPCs are in different AWS accounts, the requester block must be managed from the requester account’s Terraform, and the accepter block (or an aws_vpc_peering_connection_accepter resource with allow_remote_vpc_dns_resolution = true) must be managed from the accepter account’s Terraform.This change is an in‑place update and does not force replacement of the VPC peering connection.After updating the Terraform, terraform plan should show an in-place modification to the aws_vpc_peering_connection (and/or aws_vpc_peering_connection_accepter) resource, setting requester.allow_remote_vpc_dns_resolution and accepter.allow_remote_vpc_dns_resolution from false (or null) to true.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

DNS Resolution To Private IP Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: