Ensure that the VPC Traffic Mirroring feature is enabled and configured for your Amazon Virtual Private Cloud (VPC) networks in order to gain insight into your VPC traffic, and enable the ability to perform network and security analytics.
efficiency
When working with production and business-critical workloads, you may need to keep an ever-watchful eye out for unusual traffic patterns or content that could indicate a network intrusion, a compromised EC2 instance, or some other anomaly. VPC Traffic Mirroring is a new AWS cloud feature that you or your security teams can use with existing Virtual Private Clouds (VPCs) to capture and inspect network traffic at scale. The monitoring feature will allow you to:
- Detect network and security anomalies β this enables you to extract traffic of interest from any workload within a VPC network and route it to the detection tools of your choice. You can detect and respond to network-based attacks more quickly than is possible with traditional log-based tools.
- Gain operational insights β allows you to use VPC Traffic Mirroring feature to get the level of visibility and control that will let you make better decisions when it comes to your network security.
- Implement compliance and security controls β this helps you meet regulatory and compliance requirements that mandate monitoring, logging, and so on.
- Troubleshoot issues β allows you to mirror application traffic internally for testing and troubleshooting. This is useful for analyzing traffic patterns and proactively locate the bottlenecks that can impair the performance of your cloud applications.
Note: As an example, this conformity rule demonstrates how to identify, create, and configure VPC Traffic Mirroring resources associated with Elastic Network Interfaces (ENIs).
Audit
To determine if VPC Traffic Mirroring is used for your Amazon VPC networks, perform the following actions:
Remediation / Resolution
To enable and configure the VPC Traffic Mirroring feature for your Amazon Virtual Private Cloud (VPC) networks, perform the following actions:
Note: Make sure that the following conditions are met before you configure VPC Traffic Mirroring:- The traffic mirror source and target are either in the same VPC, or in different VPCs connected via VPC peering or a Transit Gateway.
- The traffic mirror target instance allows traffic to UDP port 4789.
- The traffic mirror source has a route table entry for the traffic mirror target.
- There are no security group rules or network ACLs on the traffic mirror target that drop the mirrored traffic from the traffic mirror source.
References
- AWS Documentation
- What is Traffic Mirroring?
- How Traffic Mirroring works
- Get started with Traffic Mirroring
- Example: Mirror inbound TCP traffic to a single monitoring appliance
- Elastic network interfaces
- AWS Command Line Interface (CLI) Documentation
- ec2
- describe-vpcs
- describe-network-interfaces
- describe-traffic-mirror-sessions
- create-traffic-mirror-target
- create-traffic-mirror-filter
- create-traffic-mirror-filter-rule
- create-traffic-mirror-session
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
![Confirmity Cloud Platform](/cloudoneconformity/assets/v2/images/common/conformity-platform-cloud.png)
You are auditing:
VPC Traffic Mirroring in Use
Risk Level: Medium