Menu
Ensure WorkSpaces are deployed in their own virtual private cloud (VPC)
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-euc-2-4The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-aws-euc-2.4 |
| description | Ensure WorkSpaces are deployed in their own virtual private cloud (VPC) |
| category | cis-end-user-compute |
| version | 1.2.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","end-user-compute","workspaces","vpc","network-segmentation","nat-gateway"] |
| cis_id | 2.4 |
| cis_benchmark | CIS AWS End User Compute Services Benchmark v1.2.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-euc-2.5"] |
| prerequisites | [] |
| severity_boost | {} |
Amazon WorkSpaces VPC should be created with two private subnets for your WorkSpaces and a NAT gateway in a public subnet.
The NAT gateway will provide WorkSpaces access to the internet for updates to the operating system and so that applications can be deployed using Amazon WorkSpaces Application Manager if that is applicable for your environment.
Your VPC's subnets must be in different Availability Zones in the Region where you're launching WorkSpaces.
Perform the following steps to confirm that a VPC exists for WorkSpaces and is configured correctly:
BlankYesYesIf this is not set as referenced above refer to the remediation procedure below.
Allocate an Elastic IP Address
Create a VPC with one public subnet and two private subnets as follows:
Login in to the VPC console at https://console.aws.amazon.com/vpc/
In the left pane, click VPC Dashboard in the upper-left corner
Click Launch VPC Wizard
Click VPC with Public and Private Subnets
Click Select
Configure the VPC as follows:
No IPv6 CIDR Blockname for the VPC (example: WorkspacesVPC)No Preferencename for the subnet (example: WorkSpaces Public Subnet)Availability Zone - Accept the default value = No Preferencename for the subnet (example: WorkSpaces Private Subnet 1)do nothingYesDefaultClick Create VPC. Note that it takes several minutes to set up your VPC. After the VPC is created
Click OK
Create a Second Private Subnet
name for the private subnet (example: WorkSpaces Private Subnet 2)select the VPC that you createdVerify and Name the Route Tables for Public
Verify and Name the Route Tables for Private
for WorkSpaces Private Subnet 2'By default, AWS Workspaces does not create its own VPC. A VPC must be created to run an AWS Workspace environment.
v8:
v7: