Project: KICS (Provisioning / Security & Compliance)
File: 0bc534c5-13d1-4353-a7fe-b8665d5c1d7d.md

title: Dynamodb VPC Endpoint Without Route Table Association hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0bc534c5-13d1-4353-a7fe-b8665d5c1d7d Query name: Dynamodb VPC Endpoint Without Route Table Association Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Dynamodb VPC Endpoint should be associated with Route Table Association<br> ```tf title="Positive test num. 1 - tf file" hl_lines="31" provider "aws" { region = "us-east-1" } locals { s3prefixlistcidrblock = "3.218.183.128/25" } resource "aws_vpc" "main" { cidr_block = "192.168.100.0/24" enablednssupport = true } resource "aws_subnet" "private-subnet" { vpcid = awsvpc.main.id cidr_block = "192.168.100.128/25" tags = { Name = "private-subnet" } } resource "awsroutetable" "private-rtb" { vpcid = awsvpc.main.id tags = { Name = "private-rtb" } } resource "awsvpcendpoint" "dynamodb-vpce-gw" { vpcid = awsvpc.main.id service_name = "com.amazonaws.us-east-1.dynamodb" } resource "awsnetworkacl" "allow-public-outbound-nacl" { vpcid = awsvpc.main.id subnetids = [awssubnet.private-subnet.id] egress { protocol = "tcp" rule_no = 200 action = "allow" cidrblock = local.s3prefixlistcidr_block from_port = 443 to_port = 443 } tags = { Name = "allow-public-outbound-nacl" } } resource "awssecuritygroup" "allow-public-outbound-sg" { name = "allow-public-outbound-sg" description = "Allow HTTPS outbound traffic" vpcid = awsvpc.main.id egress { from_port = 443 to_port = 443 protocol = "tcp" cidrblocks = [local.s3prefixlistcidr_block] } } data "aws_ami" "ubuntu" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "aws_instance" "test" { ami = data.aws_ami.ubuntu.id instance_type = "t2.micro" vpcsecuritygroupids = [awssecurity_group.allow-public-outbound-sg.id] subnetid = awssubnet.private-subnet.id } resource "awsdynamodbtable" "basic-dynamodb-table" { name = "GameScores" billing_mode = "PROVISIONED" read_capacity = 5 write_capacity = 5 hash_key = "UserId" range_key = "GameTitle" attribute { name = "UserId" type = "S" } attribute { name = "GameTitle" type = "S" } } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } locals { s3prefixlistcidrblock = "3.218.183.128/25" } resource "aws_vpc" "main2" { cidr_block = "192.168.100.0/24" enablednssupport = true } resource "aws_subnet" "private-subnet2" { vpcid = awsvpc.main2.id cidr_block = "192.168.100.128/25" tags = { Name = "private-subnet" } } resource "awsroutetable" "private-rtb2" { vpcid = awsvpc.main2.id tags = { Name = "private-rtb" } } resource "awsroutetable_association" "private-rtb-assoc2" { subnetid = awssubnet.private-subnet2.id routetableid = awsroutetable.private-rtb2.id } resource "awsvpcendpoint" "dynamodb-vpce-gw2" { vpcid = awsvpc.main2.id service_name = "com.amazonaws.us-east-1.dynamodb" } resource "awsnetworkacl" "allow-public-outbound-nacl2" { vpcid = awsvpc.main.id subnetids = [awssubnet.private-subnet2.id] egress { protocol = "tcp" rule_no = 200 action = "allow" cidrblock = local.s3prefixlistcidr_block from_port = 443 to_port = 443 } tags = { Name = "allow-public-outbound-nacl" } } resource "awssecuritygroup" "allow-public-outbound-sg2" { name = "allow-public-outbound-sg" description = "Allow HTTPS outbound traffic" vpcid = awsvpc.main.id egress { from_port = 443 to_port = 443 protocol = "tcp" cidrblocks = [local.s3prefixlistcidr_block] } } data "aws_ami" "ubuntu2" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "aws_instance" "test2" { ami = data.aws_ami.ubuntu2.id instance_type = "t2.micro" vpcsecuritygroupids = [awssecurity_group.allow-public-outbound-sg2.id] subnetid = awssubnet.private-subnet2.id } resource "awsdynamodbtable" "basic-dynamodb-table2" { name = "GameScores" billing_mode = "PROVISIONED" read_capacity = 5 write_capacity = 5 hash_key = "UserId" range_key = "GameTitle" attribute { name = "UserId" type = "S" } attribute { name = "GameTitle" type = "S" } } ```