Detection: VPC Route Table Deleted
Overview
Detect when a Virtual Private Cloud (VPC) route table was deleted. Removing a route table can disrupt traffic flow, causing connectivity issues and impacting applications and services. Monitoring route table deletions ensures network availability and protects against unauthorized or malicious changes.
References:
Usage
Run the detection in your terminal:
powerpipe detection run aws_cloudtrail_log_detections.detection.vpc_route_table_deletedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run aws_cloudtrail_log_detections.detection.vpc_route_table_deleted --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,string_split(event_source, '.')[1] || ':' || event_name as operation,request_parameters ->> 'routeTableId' as resource,user_identity.arn as actor,tp_source_ip as source_ip,tp_index as account_id,aws_region as region,tp_id as source_id,*
from aws_cloudtrail_logwhere event_source = 'ec2.amazonaws.com' and event_name = 'DeleteRouteTable' and error_code is null
order by event_time desc;