| name | cis-aws-foundations-6.6 |
| description | Ensure routing tables for VPC peering are least access |
| category | cis-networking |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","networking","vpc","vpc-peering","route-tables"] |
| cis_id | 6.6 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-6.5","cis-aws-foundations-6.8"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure routing tables for VPC peering are "least access"
Description
Once a VPC peering connection is established, routing tables must be updated to enable any connections between the peered VPCs. These routes can be as specific as desired, even allowing for the peering of a VPC to only a single host on the other side of the connection.
It is recommended that a metric filter and alarm be established for changes made to VPCs.
Rationale
Being highly selective in peering routing tables is a very effective way to minimize the impact of a breach, as resources outside of these routes are inaccessible to the peered VPC.
Impact
None specified.
Audit Procedure
Using AWS Console
Review the routing tables of peered VPCs to determine whether they route all subnets of each VPC and whether this is necessary to accomplish the intended purposes of peering the VPCs.
Using AWS CLI
- List all the route tables from a VPC and check if the "GatewayId" is pointing to a
<peering-connection-id> (e.g., pcx-1a2b3c4d) and if the "DestinationCidrBlock" is as specific as desired:
aws ec2 describe-route-tables --filter "Name=vpc-id,Values=<vpc-id>" --query "RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[*].SubnetId}"
- Alternatively, the following command can be used for improved readability:
aws ec2 describe-route-tables --query "RouteTables[].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[].SubnetId}" --output table
Expected Result
Routing tables for VPC peering connections should have the most specific CIDR blocks possible, routing only the minimum required subnets or hosts -- not entire VPC CIDR ranges.
Remediation
Using AWS Console
Review route table entries and remove overly permissive routes to peered VPCs, replacing them with specific routes to only the required subnets or hosts.
Using AWS CLI
- For each
<route-table-id> that contains routes that are non-compliant with your routing policy (granting more access than desired), delete the non-compliant route:
aws ec2 delete-route --route-table-id <route-table-id> --destination-cidr-block <non-compliant-destination-cidr>
- Create a new compliant route:
