cis-aws-euc-2-4

name	cis-aws-euc-2.4
description	Ensure WorkSpaces are deployed in their own virtual private cloud (VPC)
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","vpc","network-segmentation","nat-gateway"]
cis_id	2.4
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-euc-2.5"]
prerequisites	[]
severity_boost	{}

Ensure WorkSpaces are deployed in their own virtual private cloud (VPC) (Manual)

Profile Applicability

• Level 1

Description

Amazon WorkSpaces VPC should be created with two private subnets for your WorkSpaces and a NAT gateway in a public subnet.

Rationale

The NAT gateway will provide WorkSpaces access to the internet for updates to the operating system and so that applications can be deployed using Amazon WorkSpaces Application Manager if that is applicable for your environment.

Impact

Your VPC's subnets must be in different Availability Zones in the Region where you're launching WorkSpaces.

Audit Procedure

Using AWS Console

Perform the following steps to confirm that a VPC exists for WorkSpaces and is configured correctly:

1. Login to the VPC console at https://console.aws.amazon.com/vpc/
2. In the left pane, click Your VPC's
3. Select the VPC for WorkSpaces
4. Confirm the IPv4 settings are using a CIDR block from the private (non-publicly routable) IP address ranges. For example, 10.0.0.0/16. For more information, see the references below
5. Confirm the IPv6 CIDR Block, set to No
6. Confirm the IPv4 CIDR block for the public subnet (example - WorkSpaces Public Subnet)
   • Availability Zone, set to No Preference
7. Confirm the IPv4 CIDR block for the first private subnet (example - WorkSpaces Private Subnet 1)
   • Availability Zone, set for Amazon WorkSpaces
   • Elastic IP Allocation ID
   • Service endpoints - Blank
   • Enable DNS hostnames, set to Yes
   • Hardware tenancy, Default
8. Confirm the IPv4 CIDR block for the first private subnet (example - WorkSpaces Private Subnet 2)
   • Availability Zone set for Amazon WorkSpaces
     • NOTE: Make sure you select a different Availability zone from the one you selected for the Workspaces Private Subnet 1
   • Elastic IP Allocation ID
   • Service endpoints - Blank
   • Enable DNS hostnames, set to Yes
   • Hardware tenancy, Default

If this is not set as referenced above refer to the remediation procedure below.

Remediation

Using AWS Console

Allocate an Elastic IP Address

1. Login in to the VPC console at