Rule: VPC Route Table Should Restrict Public Access to IGW
This rule ensures VPC route tables are configured to restrict public access to internet gateways.
| Rule | VPC route table should restrict public access to IGW |
| Framework | FedRAMP Moderate Revision 4 |
| Severity | ✔ High |
VPC Route Table Restriction for Public Access to IGW for FedRAMP Moderate Revision 4
Description
The VPC (Virtual Private Cloud) route table should be configured to restrict public access to the Internet Gateway (IGW) for environments that adhere to the FedRAMP (Federal Risk and Authorization Management Program) Moderate security requirements, specifically following Revision 4.
Troubleshooting Steps
If there are any issues or concerns related to public access to the IGW in the VPC route table, the following troubleshooting steps can be followed to resolve them:
- 1.
Verify VPC Requirements: Ensure that the VPC is properly configured with the necessary subnets, security groups, and associated resources such as instances, load balancers, or NAT gateways.
- 2.
Check Route Table Configuration: Confirm that the correct route table is applied to the desired subnets within the VPC. Validate that the routing rules are appropriately set up, including any restrictions for public access to the IGW.
- 3.
Verify IGW Attachment: Ensure that the IGW is correctly attached to the VPC and associated with the relevant subnets requiring public access. Validate the VPC attachments to the IGW and their routing configurations.
- 4.
Adjust Route Rules: If required, modify the route table rules to restrict public access to the IGW. Review the rules and update them with proper restrictions, allowing only authorized traffic to utilize the IGW.
- 5.
Check Security Groups: Evaluate the security group configurations for instances that require public access. Ensure that proper inbound and outbound rules are implemented to control access to these resources.
- 6.
Test Connectivity: Once the route table changes and security group settings are adjusted, verify the connectivity by testing the access to the desired resources from within the VPC. Perform testing for both inbound and outbound traffic to ensure the desired access restrictions are in place.
Necessary Codes (if applicable)
Depending on the chosen implementation method or tools used, the following AWS CLI (Command Line Interface) codes can be utilized to create or modify the VPC route table in accordance with the required restrictions:
- 1.Create a new route table:
$ aws ec2 create-route-table --vpc-id <vpc-id>
- 1.Associate a route table with a subnet:
$ aws ec2 associate-route-table --subnet-id <subnet-id> --route-table-id <route-table-id>
- 1.Modify an existing route table:
$ aws ec2 replace-route --route-table-id <route-table-id> --destination-cidr-block <destination-cidr-block> --gateway-id <gateway-id> --dry-run
Note: Replace
<vpc-id><subnet-id><route-table-id><destination-cidr-block><gateway-id>Remediation Steps
To remediate the VPC route table and enforce the restrictions on public access to the IGW for FedRAMP Moderate Revision 4, follow these step-by-step guidelines:
- 1.
Identify the VPC: Determine the ID or name of the VPC within your AWS environment where the IGW and associated subnets exist.
- 2.
Access the AWS Management Console: Log in to the AWS Management Console using appropriate authentication credentials.
- 3.
Navigate to VPC Dashboard: Go to the VPC Dashboard by selecting the "Services" drop-down menu, searching for "VPC," and clicking on the appropriate result.
- 4.
Select Route Tables: In the VPC Dashboard, select "Route Tables" from the left-hand navigation pane.
- 5.
Identify the Correct Route Table: Identify the route table that needs to be modified based on its associated subnets and VPC configuration.
- 6.
Modify Route Table: Select the identified route table and click on the "Routes" tab in the lower pane.
- 7.
Add Route Rule: Click on the "Edit routes" or "Add route" button to modify the routing rules of the selected route table.
- 8.
Configure Access Restriction: Add a new route entry or update an existing one to restrict public access to the IGW. Specify the desired destination CIDR block (e.g., 0.0.0.0/0) and choose a non-IGW target or a "blackhole" route to block public access (e.g., Null or Interface endpoint).
- 9.
Save Changes: Save the modified route table configuration.
- 10.
Test Connectivity: Verify the changes made to the route table by testing the connectivity to the desired resources within the VPC, ensuring that public access to the IGW is now restricted as per the FedRAMP Moderate Revision 4 requirements.
Note: It is essential to comprehend the implications of the changes made to the VPC route table before implementing them, as it may impact the accessibility and functionality of resources within the VPC network.
Congratulations, you have implemented the necessary steps to restrict public access to the IGW in the VPC route table according to the FedRAMP Moderate Revision 4 requirements.