cis-aws-euc-2-5

name	cis-aws-euc-2.5
description	Ensure WorkSpaces traffic is controlled and routed through a NAT Gateway
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","nat-gateway","routing","network-traffic"]
cis_id	2.5
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-euc-2.4","cis-aws-euc-2.6"]
prerequisites	[]
severity_boost	{}

Ensure WorkSpaces traffic is controlled and routed through a NAT Gateway (Manual)

Profile Applicability

• Level 1

Description

A network address translation (NAT) gateway enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a direct connection with those instances.

Rationale

WorkSpaces must have access to the internet so that you can install updates to the operating system and deploy applications.

Impact

None specified in the benchmark.

Audit Procedure

Using AWS Console

Perform the following steps to verify a NAT Gateway is configured and utilized:

1. Login to the VPC console at https://console.aws.amazon.com/vpc/
2. In the left pane, click Route Tables
3. On the Route Table tab
4. Select the public route table set for WorkSpaces
5. Click the Subnet Associations Tab
6. Confirm that the Subnet ID is set to the WorkSpaces Public subnet
7. De-select the public route table and select the WorkSpaces Private route table
8. Click the Subnet Associations Tab
9. Confirm that the Subnet ID is set to the 2 WorkSpaces Private subnet

If the Route tables aren't set for one route for local traffic and another route that sends all other traffic to the internet gateway for the VPC refer to the remediation procedure below.

Remediation

Using AWS Console

Perform the following steps to create a NAT gateway:

1. Login to the VPC console at https://console.aws.amazon.com/vpc/

2. In the left pane, click NAT Gateways

3. Click Create NAT Gateway

4. For NAT Gateway settings:

   • Name - although optional use something to identify it with WorkSpaces
   • Specify the subnet in which to create the NAT gateway
   • Select the Elastic IP Allocation ID

5. Click Create a NAT Gateway

The NAT gateway will display in the console and after a few moments, its status will change to Available.

If the NAT gateway goes to a status of Failed, there was an error during creation.

After you've created your NAT gateway, you must update your route tables for your private subnets to point internet traffic to the NAT gateway.