Detection: VPC Peering Connection Deleted
Overview
Detect when a Virtual Private Cloud (VPC) peering connection was deleted. Deleting a peering connection can disrupt communication between interconnected VPCs, affecting applications, workflows, and distributed systems. Monitoring peering connection deletions ensures network connectivity and protects against unauthorized or malicious changes.
References:
Usage
Run the detection in your terminal:
powerpipe detection run aws_cloudtrail_log_detections.detection.vpc_peering_connection_deletedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run aws_cloudtrail_log_detections.detection.vpc_peering_connection_deleted --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,string_split(event_source, '.')[1] || ':' || event_name as operation,request_parameters ->> 'vpcId' as resource,user_identity.arn as actor,tp_source_ip as source_ip,tp_index as account_id,aws_region as region,tp_id as source_id,*
from aws_cloudtrail_logwhere event_source = 'ec2.amazonaws.com' and event_name = 'DeleteVpcPeeringConnection' and error_code is null
order by event_time desc;