01 Sign into your TrendAI Vision One™ account to access Cloud Risk Management, access Check Web-Tier ELB Subnet Connectivity to Internet Gateway rule settings, and identify the tag set defined for the AWS cloud resources created for your web tier (e.g. <web_tier_tag>:<web_tier_tag_value>).
02 Run describe-load-balancers command (OSX/Linux/UNIX) with custom query filters to list the names of all the load balancers provisioned in the selected AWS cloud region:
aws elb describe-load-balancers
--region us-east-1
--output table
--query 'LoadBalancerDescriptions[*].LoadBalancerName'
03 The command output should return a table with the requested resource names:
-------------------------
| DescribeLoadBalancers |
+-----------------------+
| cc-project5-web-elb |
| cc-frontend-web-elb |
+-----------------------+
04 Run describe-tags command (OSX/Linux/UNIX) using the name of the load balancer that you want to examine as the identifier parameter and custom query filters to describe the tags defined for the selected resource:
aws elb describe-tags
--region us-east-1
--load-balancer-name cc-project5-web-elb
--query 'TagDescriptions[*].Tags[]'
05 The describe-tags command request should return one of the following outputs:
- If the command output returns an empty array (i.e. []), as shown in the example below, the verified load balancer is not tagged at all, therefore the Audit process for the selected resource ends here:
- If the describe-tags command output returns one or more tags different than the one identified at step no. 1, as shown in the example below, the verified load balancer does not belong to your web tier, therefore the Audit process for the selected resource ends here:
[
{
"Value": "Type",
"Key": "WebBased"
}
]
- If the command output returns a tag set that matches the one identified at step no. 1 (e.g.
<web_tier_tag>:<web_tier_tag_value>), as shown in the example below, the verified load balancer is tagged as a web-tier resource, therefore the Audit process continues with the next step:
[
{
"Value": "<web_tier_tag_value>",
"Key": "<web_tier_tag>"
}
]
06 Run describe-load-balancers command (OSX/Linux/UNIX) with custom query filters to describe the ID(s) of the VPC subnet(s) associated with the web-tier load balancer identified at the previous step:
aws elb describe-load-balancers
--region us-east-1
--load-balancer-name cc-project5-web-elb
--query 'LoadBalancerDescriptions[*].Subnets[]'
07 The command output should return the ID(s) of the associated VPC subnet(s):
[
"subnet-abcd1234",
"subnet-1234abcd"
]
08 Run describe-route-tables command (OSX/Linux/UNIX) with custom query filters to describe the routes configured for the route table associated with the Amazon VPC subnets returned at the previous step:
aws ec2 describe-route-tables
--region us-east-1
--filters Name=association.subnet-id,Values=subnet-abcd1234,subnet-1234abcd
--query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}"
09 The command output should return the routes configured for the associated route table:
[
{
"Routes": [
{
"GatewayId": "local",
"DestinationCidrBlock": "172.16.0.0/16",
"State": "active",
"Origin": "CreateRouteTable"
}
],
"RouteTableId": "rtb-abcdabcd"
}
]
Check the routes returned by the
describe-route-tables command output to determine if there is a route with the
"DestinationCidrBlock" attribute set to
"0.0.0.0/0" and the "
GatewayId" attribute set to an Internet Gateway (e.g. "igw-12345678"). If the verified route table does not have a route over the Internet Gateway (i.e. a route with the destination set to 0.0.0.0/0 and the target set to the VPC's Internet Gateway), there is no connectivity between the VPC subnets associated with the selected web-tier load balancer and the VPC's Internet Gateway (IGW).
10 Repeat steps no. 6 – 9 for each web-tier load balancer returned at step no. 5.
11 Change the AWS cloud region by updating the --region command parameter value and repeat the audit process for other regions.
Security