Detection: VPC Classic Link Enabled
Overview
Detect when a Virtual Private Cloud (VPC) had the ClassicLink feature enabled. ClassicLink is a legacy feature that connects EC2-Classic instances to VPC resources but bypasses modern networking controls, increasing security and operational risks. Monitoring these configurations ensures alignment with modern VPC networking practices and reduces technical debt.
References:
Usage
Run the detection in your terminal:
powerpipe detection run aws_cloudtrail_log_detections.detection.vpc_classic_link_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run aws_cloudtrail_log_detections.detection.vpc_classic_link_enabled --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,string_split(event_source, '.')[1] || ':' || event_name as operation,request_parameters ->> 'vpcId' as resource,user_identity.arn as actor,tp_source_ip as source_ip,tp_index as account_id,aws_region as region,tp_id as source_id,*
from aws_cloudtrail_logwhere event_source = 'ec2.amazonaws.com' and event_name = 'EnableVpcClassicLink' and error_code is null
order by event_time desc;