Project: KICS (Provisioning / Security & Compliance)
File: 5a2486aa-facf-477d-a5c1-b010789459ce.md

title: EC2 Instance Has Public IP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5a2486aa-facf-477d-a5c1-b010789459ce Query name: EC2 Instance Has Public IP Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: EC2 Instance should not have a public IP address.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="17 28" data "aws_ami" "ubuntu1" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "aws_instance" "web2" { ami = data.aws_ami.ubuntu.id instance_type = "t3.micro" tags = { Name = "HelloWorld" } } resource "aws_instance" "web3" { ami = data.aws_ami.ubuntu.id associatepublicip_address = true instance_type = "t3.micro" tags = { Name = "HelloWorld" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="13" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" associatepublicip_address = true tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Negative test num. 1 - tf file" data "aws_ami" "ubuntu" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "aws_instance" "web" { ami = data.aws_ami.ubuntu.id associatepublicip_address = false instance_type = "t3.micro" tags = { Name = "HelloWorld" } } ``` ```tf title="Negative test num. 2 - tf file" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" associatepublicip_address = false tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Negative test num. 3 - tf file" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" network_interface { networkinterfaceid = awsnetworkinterface.this.id device_index = 0 } tags = { Terraform = "true" Environment = "dev" } } resource "awsnetworkinterface" "this" { subnetid = var.privatesubnet_id securitygroups = [awssecurity_group.this.id] } resource "awssecuritygroup" "this" { name = "example" description = "Example Security Group" } ```