Unused Virtual Private Gateways Should Be Removed

Using Console

To remediate the issue of Unused Virtual Private Gateways in AWS, you can follow these steps using the AWS Management Console:

Login to AWS Console: Navigate to the AWS Management Console at https://aws.amazon.com/ and login with your credentials.
Access VPC Dashboard: Go to the VPC dashboard by selecting the “Services” dropdown menu at the top left corner, then selecting “VPC” under the Networking & Content Delivery section.
Identify Unused Virtual Private Gateways:
- In the VPC dashboard, click on “Virtual Private Gateways” on the left-hand side menu.
- Review the list of Virtual Private Gateways to identify any that are not associated with any VPCs or are no longer in use.
Dissociate and Delete Unused Virtual Private Gateways:
- Select the unused Virtual Private Gateway that you want to remove.
- Click on the “Actions” dropdown menu and choose “Detach from VPC” to dissociate the Virtual Private Gateway from the VPC.
- Once detached, select the Virtual Private Gateway again and click on the “Actions” dropdown menu, then choose “Delete Virtual Private Gateway” to remove it completely.
Confirm Deletion:
- A confirmation dialog will appear asking you to confirm the deletion of the Virtual Private Gateway. Confirm the action to proceed with the deletion.
Verify Removal:
- After deleting the Virtual Private Gateway, verify that it has been successfully removed from the list of Virtual Private Gateways in the VPC dashboard.

By following these steps, you can remediate the issue of Unused Virtual Private Gateways in AWS by identifying and removing any Virtual Private Gateways that are no longer in use.

Using CLI

To remediate the issue of unused Virtual Private Gateways in AWS, you can follow the steps below using AWS CLI:

List all the Virtual Private Gateways in your AWS account:

aws ec2 describe-vpn-gateways --query 'VpnGateways[?State == `available`].{ID:VpnGatewayId}'

Identify the Virtual Private Gateways that are not associated with any VPC. These are the ones that are unused.
To detach the Virtual Private Gateway from a VPC, you can use the following command:

aws ec2 detach-vpn-gateway --vpn-gateway-id <vpn-gateway-id> --vpc-id <vpc-id>

Once you have detached the Virtual Private Gateway from all VPCs, you can delete the Virtual Private Gateway using the following command:

aws ec2 delete-vpn-gateway --vpn-gateway-id <vpn-gateway-id>

Confirm that the Virtual Private Gateway has been deleted by listing all the Virtual Private Gateways again:

aws ec2 describe-vpn-gateways --query 'VpnGateways[?State == `available`].{ID:VpnGatewayId}'

By following these steps, you can identify and remove any unused Virtual Private Gateways in your AWS account using AWS CLI.

Using Python

To remediate the issue of unused Virtual Private Gateways in AWS using Python, you can follow these steps:

Use Boto3, the AWS SDK for Python, to list all the Virtual Private Gateways in your AWS account.
Use Boto3 to list all the VPCs in your AWS account.
Compare the Virtual Private Gateways with the VPCs to identify any unused Virtual Private Gateways.
If any Virtual Private Gateways are found to be unused, delete them using Boto3.

Here is a sample Python script to achieve this:

import boto3

# Initialize the Boto3 client
ec2_client = boto3.client('ec2')

# List all Virtual Private Gateways
response = ec2_client.describe_vpn_gateways()

# List all VPCs
vpcs = ec2_client.describe_vpcs()

# Extract the VPC IDs from the VPCs response
vpc_ids = [vpc['VpcId'] for vpc in vpcs['Vpcs']]

# Identify the Virtual Private Gateways that are not associated with any VPC
unused_vpn_gateways = [vpn_gateway['VpnGatewayId'] for vpn_gateway in response['VpnGateways'] if 'VpcAttachments' not in vpn_gateway or len(vpn_gateway['VpcAttachments']) == 0]

# Delete the unused Virtual Private Gateways
for vpn_gateway_id in unused_vpn_gateways:
    ec2_client.delete_vpn_gateway(VpnGatewayId=vpn_gateway_id)
    print(f"Deleted Virtual Private Gateway: {vpn_gateway_id}")

Make sure you have the necessary permissions in your AWS IAM role to delete Virtual Private Gateways before running this script. Also, ensure you have installed the Boto3 library (pip install boto3) and configured your AWS credentials.

Using Terraform

# Virtual Private Gateway definition – mark as unused so Terraform destroys it
resource "aws_vpn_gateway" "UNUSED_VPN_GATEWAY" {
  # Set this to 0 (or false in a conditional) once you've verified the gateway
  # and any VPN connections are no longer needed; Terraform will then delete it.
  count = 0

  amazon_side_asn = 64512
  tags = {
    Name = "UNUSED_VPN_GATEWAY_NAME" # replace with the gateway's tag/name if needed
  }
}

# Any VPN connections using this gateway must be removed as well
resource "aws_vpn_connection" "UNUSED_VPN_CONNECTION" {
  count = 0

  vpn_gateway_id      = "VGW_ID_TO_DELETE"      # replace with the Virtual Private Gateway ID
  customer_gateway_id = "CUSTOMER_GATEWAY_ID"  # replace with the customer gateway ID
  type                = "ipsec.1"
}

# If you explicitly attached the gateway to a VPC via Terraform, remove the attachment
resource "aws_vpn_gateway_attachment" "UNUSED_VPN_GATEWAY_ATTACHMENT" {
  count = 0

  vpc_id         = "VPC_ID_TO_DETACH_FROM"     # replace with the VPC ID
  vpn_gateway_id = "VGW_ID_TO_DELETE"          # same as above
}

This change causes Terraform to detach and delete the unused Virtual Private Gateway and any associated VPN connections; this is a destructive, irreversible action, so only apply it after confirming they are no longer in use.terraform plan should show these resources with -/destroy (or removed from state if you delete the blocks entirely), and no new replacements being created for the unused gateway.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unused Virtual Private Gateways Should Be Removed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: