Control: 6 EFS mount targets should not be associated with subnets that assign public IP addresses on launch
Description
This control checks whether an Amazon EFS mount target is associated with subnets that assign public IP addresses on launch. The control fails if the mount target is associated with subnets that assign public IP addresses on launch.
All subnets have an attribute that determines whether a network interface created in the subnet automatically receives a public IPv4 address. Amazon EFS mount targets that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.
Remediation
To associate an existing mount target with a different subnet, you must create a new mount target in a subnet that does not assign public IP addresses on launch and then remove the old mount target. For information about managing mount targets, see Creating and managing mount targets and security groups in the Amazon Elastic File System User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_efs_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_efs_6 --shareSQL
This control uses a named query:
select mt.mount_target_id as resource, case when s.map_public_ip_on_launch then 'alarm' else 'ok' end as status, case when s.map_public_ip_on_launch then mt.file_system_id || ' mount target ' || mt.mount_target_id || ' is in subnet ' || s.subnet_id || ' that assigns public IPs on launch.' else mt.file_system_id || ' mount target ' || mt.mount_target_id || ' is in subnet ' || s.subnet_id || ' that does not assign public IPs on launch.' end as reason , mt.region, mt.account_idfrom aws_efs_mount_target mt join aws_vpc_subnet s on mt.subnet_id = s.subnet_id;