Control: 7 ElastiCache clusters should not use the default subnet group
Description
This control checks if ElastiCache clusters are configured with a custom subnet group. The control fails for an ElastiCache cluster if CacheSubnetGroupName has the value default.
When launching an ElastiCache cluster, a default subnet group is created if one doesn't exist already. The default group uses subnets from the default Virtual Private Cloud (VPC). We recommend using custom subnet groups that are more restrictive of the subnets that the cluster resides in, and the networking that the cluster inherits from the subnets.
Remediation
To create a new subnet group for an ElastiCache cluster, see Creating a subnet group in the Amazon ElastiCache User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_elasticache_7Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_elasticache_7 --shareSQL
This control uses a named query:
select arn as resource, case when cache_subnet_group_name = 'default' then 'alarm' else 'ok' end as status, case when cache_subnet_group_name = 'default' then title || ' not configured with a custom subnet group.' else title || ' configured with a custom subnet group.' end as reason , region, account_idfrom aws_elasticache_cluster;