cis-aws-euc-5-1

name	cis-aws-euc-5.1
description	Ensure AppStream is utilizing its own virtual private cloud (VPC)
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","appstream","vpc","network-isolation"]
cis_id	5.1
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	["CWE-668"]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure AppStream is utilizing its own virtual private cloud (VPC) (Manual)

Profile Applicability

• Level 1

Description

AppStream 2.0 should be configured using a VPC with Private subnets and a NAT Gateway.

Rationale

For AppStream 2.0 the public subnet will have direct access to the internet through the NAT gateway. This setup allows the streaming instances in your private subnets to connect to the internet or other AWS services.

Impact

None - this is a security best practice.

Audit Procedure

Perform the following to determine if a VPC is setup for AppStream 2.0 correctly.

Using AWS Console

1. Login to the VPC console at https://console.aws.amazon.com/vpc/

2. In the left pane, click Your VPCs

3. Select the VPC for AppStream 2.0 and take note of the name and the VPC ID

4. In the left pane, click Subnets

5. Confirm you have 3 subnets labeled and associated with the VPC:

   • 1 AppStream Public Subnet and 2 AppStream Private Subnets

6. Confirm the AppStream Public Subnet is configured correctly:

   • Select AppStream Public subnet
   • Description tab - VPC matches AppStream ID and name
   • Route Table tab - verify contains rules:
     • Example - Destination - 10.0.0.0/20, Target - local
     • Example - Destination - 0.0.0.0/0, Target - internet_gateway_ID

7. Confirm the 2 AppStream Private Subnets are configured correctly:

   • Select AppStream Private subnet 1
   • Description Tab - VPC matches AppStream ID and name and note Availability zone
   • Route Table tab - verify contains routes:
     • Example - Destination - 10.0.0.0/20, Target - local
     • Example - Destination - 0.0.0.0/0, Target - nat_gateway_ID
     • Example- optional - Destination - S3bucket_enpoint_ID, Target - storage_vpce_ID
   • Select AppStream Private subnet 2
   • Description Tab - VPC matches AppStream ID and name and Availability zone is set to something different than Private subnet 1
   • Route Table tab - verify contains routes: