Project: KICS (Provisioning / Security & Compliance)
File: 4f0908b9-eb66-433f-9145-134274e1e944.md

title: RouterTable with Default Routing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4f0908b9-eb66-433f-9145-134274e1e944 Query name: RouterTable with Default Routing Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Insecure Defaults URL: NAT gateways are recommended, and not the default route which permits all traffic, in Route Tables.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="66 61 54" Resources: VPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.1.0.0/16 EnableDnsSupport: true EnableDnsHostnames: true Tags: Key: Name Value: !Join ['', [!Ref "AWS::StackName", "-VPC" ]] InternetGateway: Type: AWS::EC2::InternetGateway DependsOn: VPC AttachGateway: Type: AWS::EC2::VPCGatewayAttachment Properties: VpcId: !Ref VPC InternetGatewayId: !Ref InternetGateway PublicSubnetA: Type: AWS::EC2::Subnet Properties: VpcId: !Ref VPC CidrBlock: 10.1.10.0/24 AvailabilityZone: !Select [ 0, !GetAZs ] # Obtenha o primeiro AZ na lista Tags: Key: Name Value: !Sub ${AWS::StackName}-Public-A Ec2Instance: Type: AWS::EC2::Instance Properties: ImageId: Fn::FindInMap: "RegionMap" Ref: "AWS::Region" "AMI" KeyName: Ref: "KeyName" NetworkInterfaces: AssociatePublicIpAddress: true DeviceIndex: "0" SubnetId: !Ref PublicSubnetA PublicRouteTable: Type: AWS::EC2::RouteTable Properties: VpcId: !Ref VPC Tags: Key: Name Value: Public PublicRoute1: Type: AWS::EC2::Route DependsOn: AttachGateway Properties: RouteTableId: !Ref PublicRouteTable DestinationCidrBlock: 0.0.0.0/0 NatGatewayId: id PublicRoute2: Type: AWS::EC2::Route DependsOn: AttachGateway Properties: RouteTableId: !Ref PublicRouteTable DestinationIpv6CidrBlock: ::/0 NatGatewayId: id PublicRoute3: Type: AWS::EC2::Route DependsOn: AttachGateway Properties: RouteTableId: !Ref PublicRouteTable DestinationCidrBlock: 10.1.10.0/24 ``` ```json title="Positive test num. 2 - json file" hl_lines="43 108 37" { "Resources": { "InternetGateway": { "Type": "AWS::EC2::InternetGateway", "DependsOn": "VPC" }, "Ec2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": { "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ] }, "KeyName": { "Ref": "KeyName" }, "NetworkInterfaces": [ { "AssociatePublicIpAddress": true, "DeviceIndex": "0", "SubnetId": "PublicSubnetA" } ] } }, "PublicRoute1": { "Type": "AWS::EC2::Route", "DependsOn": "AttachGateway", "Properties": { "NatGatewayId": "id", "RouteTableId": "PublicRouteTable", "DestinationCidrBlock": "0.0.0.0/0" } }, "PublicRoute3": { "Type": "AWS::EC2::Route", "DependsOn": "AttachGateway", "Properties": { "RouteTableId": "PublicRouteTable", "DestinationCidrBlock": "10.1.10.0/24" } }, "VPC": { "Type": "AWS::EC2::VPC", "Properties": { "Tags": [ { "Key": "Name", "Value": [ "", [ "AWS::StackName", "-VPC" ] ] } ], "CidrBlock":

"EnableDnsSupport": true, "EnableDnsHostnames": true } }, "AttachGateway": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "VpcId": "VPC", "InternetGatewayId": "InternetGateway" } }, "PublicSubnetA": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": "VPC", "CidrBlock": "10.1.10.0/24", "AvailabilityZone": [ 0, "" ], "Tags": [ { "Key": "Name", "Value": "${AWS::StackName}-Public-A" } ] } }, "PublicRouteTable": { "Type": "AWS::EC2::RouteTable", "Properties": { "VpcId": "VPC", "Tags": [ { "Key": "Name", "Value": "Public" } ] } }, "PublicRoute2": { "DependsOn": "AttachGateway", "Properties": { "RouteTableId": "PublicRouteTable", "DestinationIpv6CidrBlock": "::/0", "NatGatewayId": "id" }, "Type": "AWS::EC2::Route" } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: VPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.1.0.0/16 EnableDnsSupport: true EnableDnsHostnames: true Tags: Key: Name Value: !Join ['', [!Ref "AWS::StackName", "-VPC" ]] InternetGateway: Type: AWS::EC2::InternetGateway DependsOn: VPC AttachGateway: Type: AWS::EC2::VPCGatewayAttachment Properties: VpcId: !Ref VPC InternetGatewayId: !Ref InternetGateway PublicSubnetA: Type: AWS::EC2::Subnet Properties: VpcId: !Ref VPC CidrBlock: 10.1.10.0/24 AvailabilityZone: !Select [ 0, !GetAZs ] # Obtenha o primeiro AZ na lista Tags: Key: Name Value: !Sub ${AWS::StackName}-Public-A Ec2Instance: Type: AWS::EC2::Instance Properties: ImageId: Fn::FindInMap: "RegionMap" Ref: "AWS::Region" "AMI" KeyName: Ref: "KeyName" NetworkInterfaces: AssociatePublicIpAddress: true DeviceIndex: "0" SubnetId: !Ref PublicSubnetA PublicRouteTable: Type: AWS::EC2::RouteTable Properties: VpcId: !Ref VPC Tags: Key: Name Value: Public PublicRoute1: Type: AWS::EC2::Route DependsOn: AttachGateway Properties: RouteTableId: !Ref PublicRouteTable DestinationCidrBlock: 172.16.0.0/24 NatGatewayId: !Ref InternetGateway ``` ```json title="Negative test num. 2 - json file" { "Resources": { "VPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "10.1.0.0/16", "EnableDnsSupport": true, "EnableDnsHostnames": true, "Tags": [ { "Key": "Name", "Value": [ "", [ "AWS::StackName", "-VPC" ] ] } ] } }, "InternetGateway": { "Type": "AWS::EC2::InternetGateway", "DependsOn": "VPC" }, "AttachGateway": { "Properties": { "VpcId": "VPC", "InternetGatewayId": "InternetGateway" }, "Type": "AWS::EC2::VPCGatewayAttachment" }, "PublicSubnetA": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": "VPC", "CidrBlock": "10.1.10.0/24", "AvailabilityZone": [ 0, "" ], "Tags": [ { "Value": "${AWS::StackName}-Public-A", "Key": "Name" } ] } }, "Ec2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": { "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ] }, "KeyName": { "Ref": "KeyName" }, "NetworkInterfaces": [ { "AssociatePublicIpAddress": true, "DeviceIndex": "0", "SubnetId": "PublicSubnetA" } ] } }, "PublicRouteTable": { "Type": "AWS::EC2::RouteTable", "Properties": { "VpcId": "VPC", "Tags": [ { "Key": "Name", "Value": "Public" } ] } }, "PublicRoute1": { "Type": "AWS::EC2::Route", "DependsOn": "AttachGateway", "Properties": { "RouteTableId": "PublicRouteTable", "DestinationCidrBlock": "172.16.0.0/24", "NatGatewayId": "InternetGateway" } } } } ```