Review the routing tables of your peered AWS Virtual Private Networks (VPCs) to determine if the existing peering connection configuration is compliant with the desired routing policy. For example, a compliant routing policy could be one that limits routing to a specific subnets or EC2 instances instead of allowing routing between the entire CIDR block of each VPC available within the peering connection.
This rule can help you with the following compliance standards:
- The Center of Internet Security AWS Foundations Benchmark
- Payment Card Industry Data Security Standard (PCI DSS)
- APRA
- MAS
- NIST 800-53 (Rev. 4)
This rule can help you work with the AWS Well-Architected Framework
This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS
Having the VPC peering connection routing tables well configured to allow traffic only between the desired resources represents an effective way of minimizing the impact of security breaches as AWS resources outside of these routes become inaccessible to the peered VPC.
Note: As example, this conformity rule uses a routing policy that limits peering traffic between two specific instances available within the peered VPCs as the desired (compliant) routing policy.
Audit
To determine if the routing tables associated with your peered VPCs implement the right (compliant) routing policy, perform the following:
Remediation / Resolution
To implement the compliant routing policy for the selected AWS VPC peering connection, perform the following:
References
- AWS Documentation
- Amazon VPC FAQs
- VPC Peering Basics
- VPC Peering Configurations
- Configurations with Routes to an Entire CIDR Block
- Configurations with Specific Routes
- Updating Your Route Tables for a VPC Peering Connection
- AWS Command Line Interface (CLI) Documentation
- ec2
- describe-vpc-peering-connections
- describe-route-tables
- delete-route
- create-route
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
for and
Get started for FREE
You are auditing:
AWS VPC Peering Connections Route Tables Access
Risk level: Medium