Project: KICS (Provisioning / Security & Compliance)
File: b3a41501-f712-4c4f-81e5-db9a7dc0e34e.md

title: VPC Peering Route Table with Unrestricted CIDR hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b3a41501-f712-4c4f-81e5-db9a7dc0e34e Query name: VPC Peering Route Table with Unrestricted CIDR Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: VPC Peering Route Table should restrict CIDR<br> ```tf title="Positive test num. 1 - tf file" hl_lines="118" terraform { required_providers { aws = { source = "hashicorp/aws" version = "<= 3.49.0" } } } provider "aws" { region = "us-east-1" } variable vpc1cidr_block { type = string default = "10.0.0.0/16" description = "vpc default CIDR block" } variable vpc2cidr_block { type = string default = "10.2.0.0/16" description = "vpc default CIDR block" } variable vpccidrpublic_block { type = string default = "10.0.1.0/24" description = "public CIDR block" } variable vpccidrprivate_block { type = string default = "10.0.2.0/24" description = "private CIDR block" } resource "aws_vpc" "vpc1" { cidrblock = var.vpc1cidrblock tags = { Name = "tf-test-vpc-1" Project = "CIS Certification" } } resource "aws_subnet" "public" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrpublicblock availability_zone = "us-east-1a" tags = { Name = "public-subnet-1" Project = "CIS Certification" } } resource "aws_subnet" "private" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrprivateblock availability_zone = "us-east-1a" tags = { Name = "private-subnet-1" Project = "CIS Certification" } } resource "aws_vpc" "vpc2" { cidrblock = var.vpc2cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "awsinternetgateway" "igw" { vpcid = awsvpc.vpc1.id tags = { Name = "igw" Project = "CIS Certification" } } resource "aws_eip" "nat" {} resource "awsnatgateway" "nat" { allocationid = awseip.nat.id subnetid = awssubnet.public.*.id[0] tags = { Name = "nat" Project = "CIS Certification" } dependson = [awsinternet_gateway.igw] } data "awscalleridentity" "current" {} resource "awsvpcpeeringconnection" "mypeering" { peerownerid = data.awscalleridentity.current.account_id peervpcid = aws_vpc.vpc1.id vpcid = awsvpc.vpc2.id auto_accept = true tags = { Name = "VPC Peering between vpc1 and vpc2" Project = "CIS Certification" } } resource "awsroutetable" "publicroutetable" { vpcid = awsvpc.vpc1.id route { cidr_block = "0.0.0.0/0" vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id } tags = { Name = "publicroutetable" Project = "CIS Certification" } } resource "awsroutetable" "privateroutetable" { vpcid = awsvpc.vpc1.id route { cidrblock = awsvpc.vpc2.cidr_block vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id } tags = { Name = "privateroutetable" Project = "CIS Certification" } } resource "awsroutetableassociation" "privateroutetableassociation" { subnetid = awssubnet.private.id routetableid = awsroutetable.privateroutetable.id } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="132" terraform { required_providers { aws = { source = "hashicorp/aws" version = "<= 3.49.0" } } } provider "aws" { region = "us-east-1" } variable vpc1cidr_block { type = string default = "10.0.0.0/16" description = "vpc default CIDR block" } variable vpc2cidr_block { type = string default = "10.2.0.0/16" description = "vpc default CIDR block" } variable vpccidrpublic_block { type = string default = "10.0.1.0/24" description = "public CIDR block" } variable vpccidrprivate_block { type = string default = "10.0.2.0/24" description = "private CIDR block" } resource "aws_vpc" "vpc1" { cidrblock = var.vpc1cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "aws_subnet" "public" { vpcid = awsvpc.vpc1.id cidrblock =

availability_zone = "us-east-1a" tags = { Name = "public-subnet-1" Project = "CIS Certification" } } resource "aws_subnet" "private" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrprivateblock availability_zone = "us-east-1a" tags = { Name = "private-subnet-1" Project = "CIS Certification" } } resource "aws_vpc" "vpc2" { cidrblock = var.vpc2cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "awsinternetgateway" "igw" { vpcid = awsvpc.vpc1.id tags = { Name = "igw" Project = "CIS Certification" } } resource "aws_eip" "nat" {} resource "awsnatgateway" "nat" { allocationid = awseip.nat.id subnetid = awssubnet.public.*.id[0] tags = { Name = "nat" Project = "CIS Certification" } dependson = [awsinternet_gateway.igw] } data "awscalleridentity" "current" {} resource "awsvpcpeeringconnection" "mypeering" { peerownerid = data.awscalleridentity.current.account_id peervpcid = aws_vpc.vpc1.id vpcid = awsvpc.vpc2.id auto_accept = true tags = { Name = "VPC Peering between vpc1 and vpc2" Project = "CIS Certification" } } resource "awsroutetable" "publicroutetable9" { vpcid = awsvpc.vpc1.id tags = { Name = "public-route-table" Project = "CIS Certification" } } resource "awsroutetable" "privateroutetable" { vpcid = awsvpc.vpc1.id tags = { Project = "CIS Certification" } } resource "awsroute" "privateroute2" { routetableid = awsroutetable.publicroutetable9.id destinationcidrblock = "0.0.0.0/0" vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id dependson = [awsroutetable.publicroute_table9] } resource "awsroutetableassociation" "privateroutetableassociation" { subnetid = awssubnet.private.*.id[0] routetableid = awsroutetable.privateroutetable.id } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="118" terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.55.0" } } } provider "aws" { region = "us-east-1" } variable vpc1cidr_block { type = string default = "10.0.0.0/16" description = "vpc default CIDR block" } variable vpc2cidr_block { type = string default = "10.2.0.0/16" description = "vpc default CIDR block" } variable vpccidrpublic_block { type = string default = "10.0.1.0/24" description = "public CIDR block" } variable vpccidrprivate_block { type = string default = "10.0.2.0/24" description = "private CIDR block" } resource "aws_vpc" "vpc1" { cidrblock = var.vpc1cidrblock tags = { Name = "tf-test-vpc-1" Project = "CIS Certification" } } resource "aws_subnet" "public" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrpublicblock availability_zone = "us-east-1a" tags = { Name = "public-subnet-1" Project = "CIS Certification" } } resource "aws_subnet" "private" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrprivateblock availability_zone = "us-east-1a" tags = { Name = "private-subnet-1" Project = "CIS Certification" } } resource "aws_vpc" "vpc2" { cidrblock = var.vpc2cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "awsinternetgateway" "igw" { vpcid = awsvpc.vpc1.id tags = { Name = "igw" Project = "CIS Certification" } } resource "aws_eip" "nat" {} resource "awsnatgateway" "nat" { allocationid = awseip.nat.id subnetid = awssubnet.public.*.id[0] tags = { Name = "nat" Project = "CIS Certification" } dependson = [awsinternet_gateway.igw] } data "awscalleridentity" "current" {} resource "awsvpcpeeringconnection" "mypeering" { peerownerid = data.awscalleridentity.current.account_id peervpcid = aws_vpc.vpc1.id vpcid = awsvpc.vpc2.id auto_accept = true tags = { Name = "VPC Peering between vpc1 and vpc2" Project = "CIS Certification" } } resource "awsroutetable" "publicroutetable" { vpcid = awsvpc.vpc1.id route = [ { cidr_block = "0.0.0.0/0" vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id gateway_id = "" instance_id = "" ipv6cidrblock = "" egressonlygateway_id = "" natgatewayid = "" networkinterfaceid = "" transitgatewayid = "" carriergatewayid = "" destinationprefixlist_id = "" localgatewayid = "" vpcendpointid = "" } ] tags = { Name = "publicroutetable" Project = "CIS Certification" } } resource "awsroutetable" "privateroutetable" { vpcid =

route { cidrblock = awsvpc.vpc2.cidr_block vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id } tags = { Name = "privateroutetable" Project = "CIS Certification" } } resource "awsroutetableassociation" "privateroutetableassociation" { subnetid = awssubnet.private.id routetableid = awsroutetable.privateroutetable.id } ``` ```tf title="Negative test num. 1 - tf file" terraform { required_providers { aws = { source = "hashicorp/aws" version = "<= 3.49.0" } } } provider "aws" { region = "us-east-1" } variable vpc1cidr_block { type = string default = "10.0.0.0/16" description = "vpc default CIDR block" } variable vpc2cidr_block { type = string default = "10.2.0.0/16" description = "vpc default CIDR block" } variable vpccidrpublic_block { type = string default = "10.0.1.0/24" description = "public CIDR block" } variable vpccidrprivate_block { type = string default = "10.0.2.0/24" description = "private CIDR block" } resource "aws_vpc" "vpc1" { cidrblock = var.vpc1cidrblock tags = { Name = "tf-test-vpc-1" Project = "CIS Certification" } } resource "aws_subnet" "public" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrpublicblock availability_zone = "us-east-1a" tags = { Name = "public-subnet-1" Project = "CIS Certification" } } resource "aws_subnet" "private" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrprivateblock availability_zone = "us-east-1a" tags = { Name = "private-subnet-1" Project = "CIS Certification" } } resource "aws_vpc" "vpc2" { cidrblock = var.vpc2cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "awsinternetgateway" "igw" { vpcid = awsvpc.vpc1.id tags = { Name = "igw" Project = "CIS Certification" } } resource "aws_eip" "nat" {} resource "awsnatgateway" "nat" { allocationid = awseip.nat.id subnetid = awssubnet.public.*.id[0] tags = { Name = "nat" Project = "CIS Certification" } dependson = [awsinternet_gateway.igw] } data "awscalleridentity" "current" {} resource "awsvpcpeeringconnection" "mypeering" { peerownerid = data.awscalleridentity.current.account_id peervpcid = aws_vpc.vpc1.id vpcid = awsvpc.vpc2.id auto_accept = true tags = { Name = "VPC Peering between vpc1 and vpc2" Project = "CIS Certification" } } resource "awsroutetable" "publicroutetable" { vpcid = awsvpc.vpc1.id route { cidr_block = "10.0.0.0/8" vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id } tags = { Name = "publicroutetable" Project = "CIS Certification" } } resource "awsroutetable" "privateroutetable" { vpcid = awsvpc.vpc1.id route { cidrblock = awsvpc.vpc2.cidr_block vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id } tags = { Name = "privateroutetable" Project = "CIS Certification" } } resource "awsroutetableassociation" "privateroutetableassociation" { subnetid = awssubnet.private.id routetableid = awsroutetable.privateroutetable.id } ``` ```tf title="Negative test num. 2 - tf file" terraform { required_providers { aws = { source = "hashicorp/aws" version = "<= 3.49.0" } } } provider "aws" { region = "us-east-1" } variable vpc1cidr_block { type = string default = "10.0.0.0/16" description = "vpc default CIDR block" } variable vpc2cidr_block { type = string default = "10.2.0.0/16" description = "vpc default CIDR block" } variable vpccidrpublic_block { type = string default = "10.0.1.0/24" description = "public CIDR block" } variable vpccidrprivate_block { type = string default = "10.0.2.0/24" description = "private CIDR block" } resource "aws_vpc" "vpc1" { cidrblock = var.vpc1cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "aws_subnet" "public" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrpublicblock availability_zone = "us-east-1a" tags = { Name = "public-subnet-1" Project = "CIS Certification" } } resource "aws_subnet" "private" { vpcid = awsvpc.vpc1.id cidrblock =

availability_zone = "us-east-1a" tags = { Name = "private-subnet-1" Project = "CIS Certification" } } resource "aws_vpc" "vpc2" { cidrblock = var.vpc2cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "awsinternetgateway" "igw" { vpcid = awsvpc.vpc1.id tags = { Name = "igw" Project = "CIS Certification" } } resource "aws_eip" "nat" {} resource "awsnatgateway" "nat" { allocationid = awseip.nat.id subnetid = awssubnet.public.*.id[0] tags = { Name = "nat" Project = "CIS Certification" } dependson = [awsinternet_gateway.igw] } data "awscalleridentity" "current" {} resource "awsvpcpeeringconnection" "mypeering" { peerownerid = data.awscalleridentity.current.account_id peervpcid = aws_vpc.vpc1.id vpcid = awsvpc.vpc2.id auto_accept = true tags = { Name = "VPC Peering between vpc1 and vpc2" Project = "CIS Certification" } } resource "awsroutetable" "publicroutetable2" { vpcid = awsvpc.vpc1.id tags = { Name = "public-route-table" Project = "CIS Certification" } } resource "awsroutetable" "privateroutetable" { vpcid = awsvpc.vpc1.id tags = { Project = "CIS Certification" } } resource "awsroute" "privateroute2" { routetableid = awsroutetable.publicroutetable2.id destinationcidrblock = "10.0.0.0/8" vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id dependson = [awsroutetable.publicroute_table2] } resource "awsroutetableassociation" "privateroutetableassociation" { subnetid = awssubnet.private.*.id[0] routetableid = awsroutetable.privateroutetable.id } ``` ```tf title="Negative test num. 3 - tf file" terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.55.0" } } } provider "aws" { region = "us-east-1" } variable vpc1cidr_block { type = string default = "10.0.0.0/16" description = "vpc default CIDR block" } variable vpc2cidr_block { type = string default = "10.2.0.0/16" description = "vpc default CIDR block" } variable vpccidrpublic_block { type = string default = "10.0.1.0/24" description = "public CIDR block" } variable vpccidrprivate_block { type = string default = "10.0.2.0/24" description = "private CIDR block" } resource "aws_vpc" "vpc1" { cidrblock = var.vpc1cidrblock tags = { Name = "tf-test-vpc-1" Project = "CIS Certification" } } resource "aws_subnet" "public" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrpublicblock availability_zone = "us-east-1a" tags = { Name = "public-subnet-1" Project = "CIS Certification" } } resource "aws_subnet" "private" { vpcid = awsvpc.vpc1.id cidrblock = var.vpccidrprivateblock availability_zone = "us-east-1a" tags = { Name = "private-subnet-1" Project = "CIS Certification" } } resource "aws_vpc" "vpc2" { cidrblock = var.vpc2cidrblock tags = { Name = "tf-test-vpc-2" Project = "CIS Certification" } } resource "awsinternetgateway" "igw" { vpcid = awsvpc.vpc1.id tags = { Name = "igw" Project = "CIS Certification" } } resource "aws_eip" "nat" {} resource "awsnatgateway" "nat" { allocationid = awseip.nat.id subnetid = awssubnet.public.*.id[0] tags = { Name = "nat" Project = "CIS Certification" } dependson = [awsinternet_gateway.igw] } data "awscalleridentity" "current" {} resource "awsvpcpeeringconnection" "mypeering" { peerownerid = data.awscalleridentity.current.account_id peervpcid = aws_vpc.vpc1.id vpcid = awsvpc.vpc2.id auto_accept = true tags = { Name = "VPC Peering between vpc1 and vpc2" Project = "CIS Certification" } } resource "awsroutetable" "publicroutetable" { vpcid = awsvpc.vpc1.id route = [ { cidr_block = "10.0.0.0/8" vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id gateway_id = "" instance_id = "" ipv6cidrblock = "" egressonlygateway_id = "" natgatewayid = "" networkinterfaceid = "" transitgatewayid = "" carriergatewayid = "" destinationprefixlist_id = "" localgatewayid = "" vpcendpointid = "" } ] tags = { Name = "publicroutetable" Project = "CIS Certification" } } resource "awsroutetable" "privateroutetable" { vpcid = awsvpc.vpc1.id route { cidrblock = awsvpc.vpc2.cidr_block vpcpeeringconnectionid = awsvpcpeeringconnection.my_peering.id } tags = { Name = "privateroutetable" Project = "CIS Certification" } } resource "awsroutetableassociation" "privateroutetableassociation" { subnetid = awssubnet.private.id routetableid = awsroutetable.privateroutetable.id } ```