Amazon_VPC_25

Ensure to define VPC associations and propagations yourself to keep track of all routes and connections to and from your Transit gateway

Description

In order to control your VPC environment and Transit gateway, prefer setting the associations and propagations for your transit gateway manually. Note: Default AWS configuration of transit gateway is set to automatically define associations and propagations.

Remediation

Perform the following steps in order to set ‘Default route table association’ and ‘Default route table propagation’ to disable:
1. Sign in to the Amazon VPC console at https://console.aws.amazon.com/vpc/
2. Choose Transit Gateways
3. Choose relevant gateway and click Actions -> Modify.
4. Uncheck ‘Default route table association’ and ‘Default route table propagation’.
5. Update route table with the necessary routes.

Via CLI:
aws ec2 modify-transit-gateway –transit-gateway-id –options DefaultRouteTableAssociation=disable,DefaultRouteTablePropagation=disable

From TF:
resource aws_ec2_transit_gateway” “example” {
– default_route_table_association = “enable”
– default_route_table_propagation = “enable”
+ default_route_table_association = “disable”
+ default_route_table_propagation = “disable”
}

References :
https://docs.aws.amazon.com/vpc/latest/tgw/tgw-getting-started.html
CLI: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-transit-gateway.html

Service

VPC

Severity

Medium

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!