Project: KICS (Provisioning / Security & Compliance)
File: 8a6d36cd-0bc6-42b7-92c4-67acc8576861.md

title: Instance With No VPC hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8a6d36cd-0bc6-42b7-92c4-67acc8576861 Query name: Instance With No VPC Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: EC2 Instances should be configured under a VPC network. AWS VPCs provide the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="21" Resources: VPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.1.0.0/16 EnableDnsSupport: true EnableDnsHostnames: true Tags: Key: Name Value: !Join ['', [!Ref "AWS::StackName", "-VPC" ]] InternetGateway: Type: AWS::EC2::InternetGateway DependsOn: VPC AttachGateway: Type: AWS::EC2::VPCGatewayAttachment Properties: VpcId: !Ref VPC InternetGatewayId: !Ref InternetGateway PublicSubnetA: Type: AWS::EC2::Subnet Properties: CidrBlock: 10.1.10.0/24 AvailabilityZone: !Select [ 0, !GetAZs ] # Obtenha o primeiro AZ na lista Tags: Key: Name Value: !Sub ${AWS::StackName}-Public-A Ec2Instance-01: Type: AWS::EC2::Instance Properties: ImageId: "some-ec2-image" Fn::FindInMap: "RegionMap" Ref: "AWS::Region" "AMI" KeyName: "some-rsa-key" Ref: "KeyName" NetworkInterfaces: AssociatePublicIpAddress: "true" DeviceIndex: 0 SubnetId: !Ref PublicSubnetA ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="4" Resources: Ec2Instance-02: Type: AWS::EC2::Instance Properties: ImageId: "some-ec2-image" Fn::FindInMap: "RegionMap" Ref: "AWS::Region" "AMI" KeyName: "some-rsa-key" Ref: "KeyName" ``` ```json title="Positive test num. 3 - json file" hl_lines="35" { "Resources": { "VPC": { "Properties": { "Tags": [ { "Value": [ "", [ "AWS::StackName", "-VPC" ] ], "Key": "Name" } ], "CidrBlock": "10.1.0.0/16", "EnableDnsSupport": true, "EnableDnsHostnames": true }, "Type": "AWS::EC2::VPC" }, "InternetGateway": { "Type": "AWS::EC2::InternetGateway", "DependsOn": "VPC" }, "AttachGateway": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "VpcId": "VPC", "InternetGatewayId": "InternetGateway" } }, "PublicSubnetA": { "Properties": { "CidrBlock": "10.1.10.0/24", "AvailabilityZone": [ 0, "" ], "Tags": [ { "Key": "Name", "Value": "${AWS::StackName}-Public-A" } ] }, "Type": "AWS::EC2::Subnet" }, "Ec2Instance-01": { "Type": "AWS::EC2::Instance", "Properties": { "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ], "KeyName": "some-rsa-key", "Ref": "KeyName", "NetworkInterfaces": [ { "AssociatePublicIpAddress": "true", "DeviceIndex": 0, "SubnetId": "PublicSubnetA" } ], "ImageId": "some-ec2-image" } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="5" { "Resources": { "Ec2Instance-02": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": "some-ec2-image", "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ], "KeyName": "some-rsa-key", "Ref": "KeyName" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: VPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.1.0.0/16 EnableDnsSupport: true EnableDnsHostnames: true Tags: Key: Name Value: !Join ['', [!Ref "AWS::StackName", "-VPC" ]] InternetGateway: Type: AWS::EC2::InternetGateway DependsOn: VPC AttachGateway: Type: AWS::EC2::VPCGatewayAttachment Properties: VpcId: !Ref VPC InternetGatewayId: !Ref InternetGateway PublicSubnetA: Type: AWS::EC2::Subnet Properties: VpcId: !Ref VPC CidrBlock: 10.1.10.0/24 AvailabilityZone: !Select [ 0, !GetAZs ] # Obtenha o primeiro AZ na lista Tags: Key: Name Value: !Sub ${AWS::StackName}-Public-A Ec2Instance: Type: AWS::EC2::Instance Properties: ImageId: 'some-ec2-image' Fn::FindInMap: "RegionMap" Ref: "AWS::Region" "AMI" KeyName: 'some-rsa-key' Ref: "KeyName" NetworkInterfaces: AssociatePublicIpAddress: "true" DeviceIndex: 0 SubnetId: !Ref PublicSubnetA ``` ```json title="Negative test num. 2 - json file" { "Resources": { "VPC": { "Type": "AWS::EC2::VPC", "Properties": { "Tags": [ { "Key": "Name", "Value": [ "", [ "AWS::StackName", "-VPC" ] ] } ], "CidrBlock": "10.1.0.0/16", "EnableDnsSupport": true, "EnableDnsHostnames": true } }, "InternetGateway": { "Type": "AWS::EC2::InternetGateway", "DependsOn": "VPC" }, "AttachGateway": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "VpcId": "VPC", "InternetGatewayId": "InternetGateway" } }, "PublicSubnetA": { "Type": "AWS::EC2::Subnet", "Properties": { "CidrBlock": "10.1.10.0/24", "AvailabilityZone": [ 0, "" ], "Tags": [ { "Value": "${AWS::StackName}-Public-A", "Key": "Name" } ], "VpcId": "VPC" } }, "Ec2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "KeyName": "some-rsa-key", "Ref": "KeyName", "NetworkInterfaces": [ { "AssociatePublicIpAddress": "true", "DeviceIndex": 0, "SubnetId": "PublicSubnetA" } ], "ImageId": "some-ec2-image", "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ] } } } } ```