Check app-tier ELB subnet connectivity to Internet Gateway

01 Sign in to your Cloud Conformity console, access Check app-tier ELB subnet connectivity to Internet Gateway conformity rule settings, identify and copy the tag set defined for all AWS resources available in your app tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Sign in to the AWS Management Console.

03 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

04 In the navigation panel, under LOAD BALANCING, click Load Balancers.

05 Paste the tag set copied at step no. 1 in the Filter by tags and attributes or search by keyword box, then add a space before and after the separation colon (i.e. <app_tier_tag> : <app_tier_tag_value>) and press Enter. This filtering method will return only the ELBs tagged for the app tier. If no results are returned, there are no ELBs tagged within your app tier and the audit process ends here. If the AWS console lists one or more load balancers, continue the audit with the next step.

06 Select the app-tier load balancer that you want to examine.

07 Select the Description tab from the bottom panel to access the resource configuration details.

08 In the Basic Configuration section, search for the Availability Zones attribute. Click on the first value (i.e. subnet ID - AZ name link) set for the Availability Zones configuration attribute. The console will redirect you to the Subnets page on the VPC dashboard.

09 Click on the VPC subnet chosen at the previous step and select the Route Table tab from the dashboard bottom panel to access the routes configured for the selected subnet. Check the existing routes to determine if these contain the default route (i.e. the route with Destination set to 0.0.0.0/0) pointing to an AWS Internet Gateway (e.g. igw-abcd1234). If there is no such route available, the selected subnet configuration is not compliant.

10 Repeat step no. 8 and 9 to check the rest of the associated subnets for configured route tables. If none of the verified route tables have a route over the Internet Gateway (i.e. the destination is 0.0.0.0/0 and the target is the VPC’s Internet gateway), there is no connectivity between the subnets associated with the app-tier load balancer and the VPC’s Internet Gateway (IGW).

11 If required, change the AWS region from the navigation bar and repeat steps no. 5 – 10 for other regions.

01 Sign in to your Cloud Conformity console, access Check app-tier ELB subnet connectivity to Internet Gateway conformity rule settings, identify and copy the tag set defined for all AWS resources available in your app tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Run describe-load-balancers command (OSX/Linux/UNIX) to list the names of all AWS ELBs available in the selected AWS region:

aws elb describe-load-balancers
	--region us-east-1
	--output table
	--query 'LoadBalancerDescriptions[*].LoadBalancerName'

03 The command output should return a table with the requested ELB names:

-------------------------
| DescribeLoadBalancers |
+-----------------------+
|   cc-front-app-elb    |
|   cc-project5-elb     |
+-----------------------+

04 Run describe-tags command (OSX/Linux/UNIX) using the name of the load balancer that you want to examine as identifier and custom query filters to describe the tags defined for the selected ELB resource:

aws elb describe-tags
	--region us-east-1
	--load-balancer-name cc-front-app-elb
	--query 'TagDescriptions[*].Tags[]'

05 The command request should return one of the following outputs:

1. If the describe-tags command output returns an empty array (i.e. []), as shown in the example below, the verified load balancer is not tagged, therefore the audit process for the selected resource ends here:
   []
   

2. If the command output returns a set of tags that is different than the one copied at step no. 1, as shown in the example below, the verified ELB does not belong to your app tier, hence the audit process for the selected resource ends here:
   [
       {
           "Value": "DevTeam",
           "Key": "Melbourne"
       }
   ]
   

3. If the describe-tags command output returns a set of tags that match the one copied at step no. 1 (e.g. <app_tier_tag>:<app_tier_tag_value>), as shown in the example below, the verified Amazon ELB is tagged as a app-tier resource, therefore the audit process continues with the next step:
   [
       {
           "Value": "<app_tier_tag_value>",
           "Key": "<app_tier_tag>"
       }
   ]
   

06 Run describe-load-balancers command (OSX/Linux/UNIX) using the name of the app-tier ELB identified at the previous step to list the subnets associated with the selected load balancer:

aws elb describe-load-balancers
	--region us-east-1
	--load-balancer-name cc-front-app-elb
	--query 'LoadBalancerDescriptions[*].Subnets[]'

07 The command output should return the IDs of the associated subnets:

[
    "subnet-1234abcd",
    "subnet-abcdabcd",
    "subnet-aaaabbbb"
]

08 Run describe-route-tables command (OSX/Linux/UNIX) to describe the routes configured for the route table associated with the VPC subnets returned at the previous step, available in the selected AWS region:

aws ec2 describe-route-tables
	--region us-east-1
	--filters Name=association.subnet-id,Values=subnet-1234abcd,subnet-abcdabcd,subnet-aaaabbbb
	--query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}"

09 The command output should return the existing route(s) for the associated route table:

[
    {
        "Routes": [
            {
                "GatewayId": "local",
                "DestinationCidrBlock": "172.31.0.0/16",
                "State": "active",
                "Origin": "CreateRouteTable"
            }
        ],
        "RouteTableId": "rtb-aabbccdd"
    }
]

10 If required, change the AWS region by updating the --region command parameter value and repeat steps no. 2 – 9 for other regions.

01 Sign in to the AWS Management Console.

02 Navigate to VPC dashboard at https://console.aws.amazon.com/vpc/.

03 Select the Virtual Private Cloud where the app-tier load balancer subnets are deployed from Select a VPC dropdown menu.

04 In the navigation panel, under Virtual Private Cloud, click Route Tables.

05 Select the route table that you want to reconfigure (see Audit section part I to identify the right VPC resource).

06 Select the Routes tab from the bottom panel to access the table routing configuration.

07 On the Routes panel, choose Edit, then click Add another rule button add a new route.

08 Type 0.0.0.0/0 in the Destination box then click inside the Target box and select the ID of the Internet Gateway (IGW) configured for the current VPC.

09 Click Save to create the route and apply it to the existing route table. The new route matches all IPv4 traffic (i.e. 0.0.0.0/0) and routes it to the Internet Gateway available within the same VPC as the app-tier load balancer.

10 If required, change the AWS region from the navigation bar and repeat steps no. 3 – 9 for other regions.

01 Run create-route command (OSX/Linux/UNIX) using the ID of the route table that you want to reconfigure (see Audit section part II to identify the right resource) as identifier to create a new route that matches all IPv4 traffic (i.e. 0.0.0.0/0) and routes it to the Internet Gateway (IGW) available within the Virtual Private Cloud that hosts the app-tier ELB:

aws ec2 create-route
	--region us-east-1
	--route-table-id rtb-aabbccdd
	--destination-cidr-block 0.0.0.0/0
	--gateway-id igw-abcd1234

02 The command output should return true if the request succeeds, otherwise, it should return an error:

{
    "Return": true
}

03 If required, change the AWS region by updating the --region command parameter value and repeat step no. 1 and 2 for other regions.