01 Run ListVpcPeerConnections command (OSX/Linux/UNIX) to describe the configuration information available for each VPC peering connection created in the specified cloud region:
aliyun vpcpeer ListVpcPeerConnections --RegionId 'eu-west-1'
02 The command output should return the requested information (including the requester VPC ID: "VpcPeerConnects.Vpc.VpcId" and the accepter VPC ID: "VpcPeerConnects.AcceptingVpc.VpcId"):
{
"VpcPeerConnects": [
{
"AcceptingOwnerUid": 1234567890123456,
"AcceptingRegionId": "eu-west-1",
"AcceptingVpc": {
"VpcId": "vpc-abcd1234abcd1234abcda"
},
"Bandwidth": -1,
"BizStatus": "Normal",
"GmtCreate": "2024-02-28T15:55:28Z",
"GmtModified": "2024-02-28T15:55:30Z",
"InstanceId": "pcc-1234abcd1234abcd12",
"Name": "tm-vpc-peering-connection",
"OwnerId": 1234567890123456,
"RegionId": "eu-west-1",
"ResourceGroupId": "rg-abcdv1234abcd14",
"Status": "Activated",
"Vpc": {
"VpcId": "vpc-1234abcd1234abcd1234a"
}
}
],
"MaxResults": 20,
"RequestId": "ABCDABCD-1234-ABCD-1234-ABCD1234ABCD",
"TotalCount": 1,
}
03 Run DescribeRouteTableList command (OSX/Linux/UNIX) using the ID of the requester/accepter VPC as the identifier parameter, to describe the configuration information available for each route table defined for the selected VPC:
aliyun vpc DescribeRouteTableList --RegionId 'eu-west-1' --VpcId 'vpc-1234abcd1234abcd1234a'
04 The command output should return the requested information (including the route table ID, i.e. "RouterTableList.RouterTableListType.RouteTableId"):
{
"RouterTableList": {
"RouterTableListType": [
{
"AssociateType": "VSwitch",
"CreationTime": "2024-01-25T08:27:25Z",
"Description": "",
"GatewayIds": {
"GatewayIds": []
},
"OwnerId": 1234567890123456,
"ResourceGroupId": "rg-abcdv1234abcd14",
"RoutePropagationEnable": true,
"RouteTableId": "vtb-abcdabcdabcdabcdabcda",
"RouteTableName": "",
"RouteTableType": "System",
"RouterId": "vrt-123412341234123412341",
"RouterType": "VRouter",
"Status": "Available",
"VSwitchIds": {
"VSwitchId": [
"vsw-1234abcd1234abcd1234a"
]
},
"VpcId": "vpc-1234abcd1234abcd1234a"
}
]
},
"Success": true,
"TotalCount": 1,
"Code": "200",
"Message": "successful",
"PageNumber": 1,
"PageSize": 10,
"RequestId": "ABCDABCD-1234-ABCD-1234-ABCD1234ABCD"
}
05 Run DescribeRouteEntryList command (OSX/Linux/UNIX) using the ID of the route table that you want to examine as the identifier parameter, to describe the custom routes created for the selected route table:
aliyun vpc DescribeRouteEntryList
--RegionId 'eu-west-1'
--RouteTableId 'vtb-abcdabcdabcdabcdabcda'
--RouteEntryType Custom
06 The command output should return the requested configuration information:
{
"RouteEntrys": {
"RouteEntry": [
{
"Description": "",
"DestinationCidrBlock": "172.16.0.0/16",
"GmtModified": "2024-02-28T16:02:34Z",
"IpVersion": "ipv4",
"NextHops": {
"NextHop": [
{
"NextHopId": "pcc-1234abcd1234abcd12",
"NextHopRelatedInfo": {},
"NextHopType": "VpcPeer"
}
]
},
"Origin": "CustomCreate",
"RouteEntryId": "rte-123412341234123412341",
"RouteEntryName": "tm-accept-vpc-route",
"RouteTableId": "vtb-abcdabcdabcdabcdabcda",
"ServiceType": "",
"Status": "Available",
"Type": "Custom"
}
]
},
"NextToken": "",
"RequestId": "ABCDABCD-1234-ABCD-1234-ABCD1234ABCD"
}
Check the
"DestinationCidrBlock" attribute value for each route entry returned by the
DescribeRouteEntryList command output. If the
"DestinationCidrBlock" value for one or more routes is an entire IPv4 CIDR block of the peer VPC, e.g. 172.16.0.0/16 (as shown in the output example above), or an IPv4 range, such as 172.16.1.0/24, the selected VPC peering connection is not configured to use least access routing policies. A least access routing policy limits peering traffic to a specific IPv4 address such as 172.16.20.105/32.
07 Repeat steps no. 3 and 4 for each VPC network available in the selected cloud region.
08 Change the cloud region by updating the --RegionId command parameter value and repeat the Audit process for other regions.
Security