Restrict Data-Tier Subnet Connectivity to VPC NAT Gateway

Risk Level: Medium (should be achieved)

Ensure that the Amazon VPC route table associated with the data-tier subnets has no default route (i.e. 0.0.0.0/0) configured to allow access to an Amazon NAT Gateway in order to restrict Internet connectivity for the EC2 instances available within the data tier. A route table contains a set of rules (also known as routes) that are used to determine where the network traffic is directed. Each subnet deployed in your VPC must be associated with a route table to control the routing. The route table associated with the data-tier subnets should not have a default route (0.0.0.0/0) that points to a NAT Gateway. This conformity rule assumes that the VPC subnets within your data tier are tagged with <data_tier_tag>:<data_tier_tag_value>, where <data_tier_tag> represents the tag name and <data_tier_tag_value> represents the tag value. Before running this rule by the Trend Cloud One™ – Conformity engine, the data-tier tags must be configured in the rule settings, on your Conformity account console.

Security

For security reasons, your data-tier instances must be protected from exposure. Therefore, the route table associated with your data-tier subnets should not have the default route pointing to an Amazon NAT Gateway as this type of network device is used only to enable instances within a private subnet to connect to the Internet.

Note: Make sure that you replace all <data_tier_tag>:<data_tier_tag_value> tag placeholders outlined in the conformity rule content with your own tag set created for the data tier.

Audit

To determine if the route table associated with your data-tier VPC subnets contains a default route (0.0.0.0/0) that has a NAT device configured as gateway, perform the following actions:

Using AWS Console

01 Sign in to your Trend Cloud One™ – Conformity account, access Restrict Data-Tier Subnet Connectivity to VPC NAT Gateway conformity rule settings, and identify the tag set defined for the AWS cloud resources created for your data tier (e.g. <data_tier_tag>:<data_tier_tag_value>).

02 Sign in to the AWS Management Console.

03 Navigate to Amazon VPC console at https://console.aws.amazon.com/vpc/.

04 Select the Virtual Private Cloud (VPC) that you want to examine from the Select a VPC dropdown menu.

05 In the navigation panel, under VIRTUAL PRIVATE CLOUD, choose Subnets.

06 Select the VPC subnet that you want to examine and choose the Tags tab from the console bottom panel.

07 In the Tags section, search for the tag set identified at step no. 1 (i.e. <data_tier_tag>:<data_tier_tag_value>). If the verified VPC resource is not tagged with the data-tier tags identified at step no. 1, the selected Amazon VPC subnet is not a component of your data tier and the Audit process ends here. If the selected VPC subnet is tagged with your data-tier tags, continue the Audit process with the next step.

08 Select the Route table tab from the console bottom panel to access the routes configured for the selected data-tier subnet. Check the existing routes to determine if the default route (i.e. the route with the Destination set to 0.0.0.0/0) is pointing to a NAT Gateway (e.g. nat-01234abcd1234abcd). If the default route points to a VPC NAT Gateway, the route table configuration is not compliant.

09 Repeat steps no. 6 – 8 to check the routing configuration for other data-tier subnets available. If one or more route tables have the default route linked to a VPC NAT Gateway, the data-tier Amazon EC2 instances have access to the Internet, therefore the VPC network configuration is not compliant.

10 Repeat steps no. 4 – 9 for each VPC created within the current AWS region.

11 Change the AWS cloud region from the console navigation bar and repeat the audit process for other regions.

Using AWS CLI

02 Run describe-vpcs command (OSX/Linux/UNIX) with custom query filters to list the IDs of all the Virtual Private Clouds (VPCs) available in the selected AWS cloud region:

aws ec2 describe-vpcs
  --region us-east-1
  --output table
  --query 'Vpcs[*].VpcId'

03 The command output should return a table with the requested identifiers (IDs):

------------------
|  DescribeVpcs  |
+----------------+
|  vpc-abcdabcd  |
|  vpc-12341234  |
+----------------+

04 Run describe-subnets command (OSX/Linux/UNIX) to list the IDs of the data-tier subnets created for the Virtual Private Cloud (VPC) that you want to examine. Replace <data_tier_tag> and <data_tier_tag_value> with your data-tier tag set identified at step no. 1:

aws ec2 describe-subnets
  --region us-east-1
  --filters Name=tag:<data_tier_tag>,Values=<data_tier_tag_value> Name=vpc-id,Values=vpc-abcdabcd
  --query "Subnets[*].SubnetId"

05 The command request should return one of the following outputs:

If the command output returns an empty array (i.e. []), as shown in the example below, there are no VPC subnets created for your data tier in the selected AWS region, therefore the Audit process for the selected resource ends here:
```
[]
```
If the describe-subnets command output returns an array with subnet IDs, as shown in the example below, there are data-tier subnets available within the selected Virtual Private Cloud (VPC), therefore the Audit process continues with the next step:
```
[
	"subnet-1234abcd",
	"subnet-abcd1234"
] 
```

06 Run describe-route-tables command (OSX/Linux/UNIX) to describe the routes configured for the route table associated with the data-tier VPC subnets returned at the previous step:

aws ec2 describe-route-tables
  --region us-east-1
  --filters Name=association.subnet-id,Values=subnet-1234abcd,subnet-abcd1234
  --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}"

07 The command output should return the existing route(s) for the associated route table:

[
	{
		"Routes": [
			{
				"GatewayId": "local",
				"DestinationCidrBlock": "172.31.0.0/16",
				"State": "active",
				"Origin": "CreateRouteTable"
			},
			{
				"Origin": "CreateRoute",
				"DestinationCidrBlock": "0.0.0.0/0",
				"NatGatewayId": "nat-01234abcd1234abcd",
				"State": "active"
			}
		],
		"RouteTableId": "rtb-12345678"
	}
]

Check the routes returned by the describe-subnets command output to determine if there is a route with the "DestinationCidrBlock" attribute set to "0.0.0.0/0" and the "NatGatewayId" attribute set to a VPC NAT Gateway ID such as "nat-01234abcd1234abcd". If the verified route table has the default route linked to a VPC NAT Gateway, as shown in the output example above, the data-tier Amazon EC2 instances have access to the Internet, therefore the VPC network configuration is not compliant.

08 Repeat steps no. 4 – 7 for each VPC available within the selected AWS region.

09 Change the AWS cloud region by updating the --region command parameter value and repeat the audit process for other regions.

Remediation / Resolution

To remove the default route that points to a NAT Gateway from the route table associated with your data-tier VPC subnets, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon VPC console at https://console.aws.amazon.com/vpc/.

03 Select the Virtual Private Cloud (VPC) that you want to access from the Select a VPC dropdown menu.

04 In the navigation panel, under VIRTUAL PRIVATE CLOUD, choose Route Tables.

05 Select the route table that you want to reconfigure (see Audit section part I to identify the right VPC route table).

06 Select the Routes tab from the console bottom panel and choose Edit routes.

07 On the Edit routes configuration page, find the non-compliant route entry, i.e. the one with the Destination set to 0.0.0.0/0 and the Target set to a VPC NAT Gateway such as nat-01234abcd1234abcd, then click on the x (delete) button to remove the selected route from your route table. Choose Save routes to apply the configuration changes. The associated data-tier subnet connectivity to the VPC NAT Gateway is now restricted.

08 Repeat steps no. 5 – 7 for each non-compliant route table created for the selected VPC.

09 Repeat steps no. 3 – 8 for each VPC available within the current AWS region.

10 Change the AWS cloud region from the console navigation bar and repeat the remediation process for other regions.

Using AWS CLI

01 Run delete-route command (OSX/Linux/UNIX) using the ID of the non-compliant route table that you want to reconfigure as the identifier parameter (see Audit section part II to identify the right VPC resource), to remove the default route that has a VPC NAT device configured as gateway, from the selected route table (the command does not produce an output):

aws ec2 delete-route
  --region us-east-1
  --route-table-id rtb-12345678
  --destination-cidr-block 0.0.0.0/0

02 Repeat step no. 1 for each non-compliant route table created for your VPC network.

03 Change the AWS cloud region by updating the --region command parameter value and repeat the remediation process for other regions.

References

AWS Command Line Interface (CLI) Documentation
ec2
describe-vpcs
describe-subnets
describe-route-tables
delete-route

Publication date Jul 25, 2018

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS Console

Using AWS CLI

References

Related EC2 rules