Control: 25 Amazon EC2 launch templates should not assign public IPs to network interfaces
Description
This control checks if Amazon EC2 launch templates are configured to assign public IP addresses to network interfaces upon launch. The control fails if an EC2 launch template is configured to assign a public IP address to network interfaces or if there is at least one network interface that has a public IP address.
A public IP address is one that is reachable from the internet. If you configure your network interfaces with a public IP address, then the resources associated with those network interfaces may be reachable from the internet. EC2 resources shouldn't be publicly accessible because this may permit unintended access to your workloads.
Remediation
To update an EC2 launch template, see Change the default network interface settings in the Amazon EC2 Auto Scaling User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_ec2_25Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_ec2_25 --shareSQL
This control uses a named query:
with public_launch_templates as ( select i.tags ->> 'aws:ec2launchtemplate:id' as public_launch_template_id from aws_ec2_instance as i, jsonb_array_elements(launch_template_data -> 'NetworkInterfaces') as nic where (nic -> 'AssociatePublicIpAddress')::bool),launch_templates_associated_instance as ( select distinct tags ->> 'aws:ec2launchtemplate:id' as launch_template_id from aws_ec2_instance)select t.launch_template_id as resource, case when i.launch_template_id is null then 'skip' when t.launch_template_id in ( select public_launch_template_id from public_launch_templates ) then 'alarm' else 'ok' end as status, case when i.launch_template_id is null then t.title || ' does not launch any instance.' when t.launch_template_id in ( select public_launch_template_id from public_launch_templates ) then t.title || ' publicly accessible.' else t.title || ' not publicly accessible.' end as reason , t.region, t.account_idfrom aws_ec2_launch_template as t left join launch_templates_associated_instance as i on i.launch_template_id = t.launch_template_id;