Unused EC2 EIPs Removal Rule
This rule states that Unused EC2 Elastic IPs should be removed to ensure compliance with PCI standards.
| Rule | Unused EC2 EIPs should be removed |
| Framework | PCI v3.2.1 |
| Severity | ✔ Low |
Rule Description:
Unused EC2 EIPs (Elastic IP addresses) should be removed for compliance with PCI DSS v3. Elastic IP addresses are static, public IP addresses that can be attached to EC2 instances. These addresses are meant for dynamic assignment and should not be left unused, as it can increase security risks.
Troubleshooting Steps:
- 1.Identify all the Elastic IP addresses associated with your AWS account.
- 2.Determine whether these addresses are actively being used or not.
- 3.For any unused Elastic IP addresses, take the necessary steps to remove them.
Necessary Codes:
There are no specific codes for this rule. However, you can use the AWS Command Line Interface (CLI) to facilitate the troubleshooting and remediation steps.
Step-by-Step Guide for Remediation:
Step 1: Identify Unused Elastic IP Addresses
- 1.Open the AWS Management Console and navigate to the EC2 dashboard.
- 2.Click on "Elastic IPs" in the left navigation pane.
- 3.Review the list of Elastic IP addresses associated with your AWS account.
- 4.Identify any IP addresses that are not currently associated with a running EC2 instance.
Step 2: Determine the Status of Elastic IP Addresses
- 1.Note down the allocation ID and IP address of any unused Elastic IP addresses.
- 2.Open the AWS CLI or use the AWS CloudShell for command line access.
- 3.Run the following command to check the association status of the Elastic IP addresses:
aws ec2 describe-addresses --public-ips <EIP-1> <EIP-2> ...
Replace
<EIP-1><EIP-2>- 1.Review the output and identify the Elastic IP addresses that are not associated with any instance.
Step 3: Detach Unused Elastic IP Addresses
- 1.Run the following command to detach an Elastic IP address from any associated EC2 instance:
aws ec2 disassociate-address --association-id <ASSOCIATION-ID>
Replace
<ASSOCIATION-ID>- 1.Repeat this command for each unused Elastic IP address that needs to be detached.
Step 4: Release Unused Elastic IP Addresses
- 1.Run the following command to release an unused Elastic IP address:
aws ec2 release-address --allocation-id <ALLOCATION-ID>
Replace
<ALLOCATION-ID>- 1.Repeat this command for each unused Elastic IP address that needs to be released.
Step 5: Verification
- 1.After running the release command, verify that the Elastic IP addresses no longer appear in the list of allocated addresses or the EC2 dashboard.
By following these steps, you can ensure that any unused Elastic IP addresses are removed from your AWS account, complying with the PCI DSS v3 requirement.