cis-aws-foundations-6-6

name	cis-aws-foundations-6.6
description	Ensure routing tables for VPC peering are least access
category	cis-networking
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","networking","vpc","vpc-peering","route-tables"]
cis_id	6.6
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-6.5","cis-aws-foundations-6.8"]
prerequisites	[]
severity_boost	{}

Ensure routing tables for VPC peering are "least access"

Description

Once a VPC peering connection is established, routing tables must be updated to enable any connections between the peered VPCs. These routes can be as specific as desired, even allowing for the peering of a VPC to only a single host on the other side of the connection.

It is recommended that a metric filter and alarm be established for changes made to VPCs.

Rationale

Being highly selective in peering routing tables is a very effective way to minimize the impact of a breach, as resources outside of these routes are inaccessible to the peered VPC.

Impact

None specified.

Audit Procedure

Using AWS Console

Review the routing tables of peered VPCs to determine whether they route all subnets of each VPC and whether this is necessary to accomplish the intended purposes of peering the VPCs.

Using AWS CLI

1. List all the route tables from a VPC and check if the "GatewayId" is pointing to a <peering-connection-id> (e.g., pcx-1a2b3c4d) and if the "DestinationCidrBlock" is as specific as desired:

aws ec2 describe-route-tables --filter "Name=vpc-id,Values=<vpc-id>" --query "RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[*].SubnetId}"

2. Alternatively, the following command can be used for improved readability:

aws ec2 describe-route-tables --query "RouteTables[].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[].SubnetId}" --output table

Expected Result

Routing tables for VPC peering connections should have the most specific CIDR blocks possible, routing only the minimum required subnets or hosts -- not entire VPC CIDR ranges.

Remediation

Using AWS Console

Review route table entries and remove overly permissive routes to peered VPCs, replacing them with specific routes to only the required subnets or hosts.

Using AWS CLI

1. For each <route-table-id> that contains routes that are non-compliant with your routing policy (granting more access than desired), delete the non-compliant route:

aws ec2 delete-route --route-table-id <route-table-id> --destination-cidr-block <non-compliant-destination-cidr>

2. Create a new compliant route: