Control: EFS mount targets should not be associated with subnets that assign public IP addresses on launch
Description
This control checks whether an Amazon EFS mount target is associated with subnets that assign public IP addresses on launch. The control fails if the mount target is associated with subnets that assign public IP addresses on launch.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.efs_mount_target_not_publicly_accessibleSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.efs_mount_target_not_publicly_accessible --shareSQL
This control uses a named query:
select mt.mount_target_id as resource, case when s.map_public_ip_on_launch then 'alarm' else 'ok' end as status, case when s.map_public_ip_on_launch then mt.file_system_id || ' mount target ' || mt.mount_target_id || ' is in subnet ' || s.subnet_id || ' that assigns public IPs on launch.' else mt.file_system_id || ' mount target ' || mt.mount_target_id || ' is in subnet ' || s.subnet_id || ' that does not assign public IPs on launch.' end as reason , mt.region, mt.account_idfrom aws_efs_mount_target mt join aws_vpc_subnet s on mt.subnet_id = s.subnet_id;