Review the routing tables of your peered AWS Virtual Private Networks (VPCs) to determine if the existing peering connection configuration is compliant with the desired routing policy. For example, a compliant routing policy could be one that limits routing to a specific subnets or EC2 instances instead of allowing routing between the entire CIDR block of each VPC available within the peering connection.
Having the VPC peering connection routing tables well configured to allow traffic only between the desired resources represents an effective way of minimizing the impact of security breaches as AWS resources outside of these routes become inaccessible to the peered VPC. Note: As example, this conformity rule uses a routing policy that limits peering traffic between two specific instances available within the peered VPCs as the desired (compliant) routing policy.
To determine if the routing tables associated with your peered VPCs implement the right (compliant) routing policy, perform the following:
To implement the compliant routing policy for the selected AWS VPC peering connection, perform the following: