AWS logo
Amazon QDetector Library

Restrict public IP association on EC2 instance High

EC2 instance configured with public IP is detected. To minimize the risk of unauthorized access to your instances, do not allow public IP associations unless absolutely necessary.

Detector ID
cloudformation/restrict-public-ip-ec2-cloudformation@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1Resources:
2  Resource:
3    Type: AWS::EC2::Instance
4    Properties:
5      DisableApiTermination: false
6      InstanceInitiatedShutdownBehavior: stop
7      ImageId: !FindInMap
8        - AmazonLinuxNatAMI
9        - !Ref 'AWS::Region'
10        - hvm
11      InstanceType: t2.micro
12      KeyName: !Ref KeyPair
13      Monitoring: false
14      NetworkInterfaces:
15        - DeleteOnTermination: true
16          Description: Primary network interface
17          DeviceIndex: '0'
18          SubnetId: !Ref VPCPubSn1
19          GroupSet:
20            - !Ref SGAllTrafficFromVPC
21          # Noncompliant: EC2 instance have public IP.
22          AssociatePublicIpAddress: true

Compliant example

1Resources:
2  Resource:
3    Type: 'AWS::EC2::Instance'
4    Properties:
5      # Compliant: EC2 instance do not have public IP.
6      DisableApiTermination: false
7      InstanceInitiatedShutdownBehavior: stop
8      ImageId: !FindInMap
9        - AmazonLinuxNatAMI
10        - !Ref 'AWS::Region'
11        - hvm
12      InstanceType: t2.micro
13      KeyName: !Ref KeyPair
14      Monitoring: false