Control: 3.4 Ensure routing tables for VPC peering are 'least access'
Description
Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired, even peering a VPC to only a single host on the other side of the connection.
Remediation
- Logon to VPC console.
- Open the
Routing Table. - Remove and add
route table entriesto ensure thatthe least number of subnets or hostsas is required to accomplish the purpose for peering are routable.
Default Value:
Routing table is empty by default upon creation for any newly created routing table, hence it denies any default access.
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v200_3_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v200_3_4 --shareSQL
This control uses a named query:
select 'arn:acs:::' || account_id as resource, 'info' as status, 'Manual verification required.' as reason , account_id as account_idfrom alicloud_account;