Ensure that a custom route table is created and associated with your private subnets in order to control the subnets routing. A route table contains a set of routes that are used to determine where the network traffic is directed. The custom route table associated with private subnets should contain only the default route (0.0.0.0/0) pointing to an AWS NAT Gateway. A private subnet can be associated only with one route table at a time, however, you can associate multiple private subnets with the same route table. This conformity rule assumes that the private subnets created for specific tiers within your VPC are tagged with <web_tier_tag>:<web_tier_tag_value> for web tier, <app_tier_tag>:<app_tier_tag_value> for app tier and <data_tier_tag>:<data_tier_tag_value> for the data tier, where <web/app/data_tier_tag> is the tag name and <web/app/data_tier_tag_value> is the tag value. Prior to running this rule by the Cloud Conformity engine, the web/app/data tier tags must be configured in the rule settings, on your Cloud Conformity account dashboard.
To control the routing for your private subnets you need to create custom route tables. Once these VPC resources are created, all the subnets which should be private within web, app and data tiers can be explicitly associated with the new route tables.
Note: Ensure that you replace all <web_tier_tag>:<web_tier_tag_value>, <app_tier_tag>:<app_tier_tag_value> and <data_tier_tag>:<data_tier_tag_value> tag placeholders found in the conformity rule content with your own tag name and value.
To determine if the private subnets created for your web, app and data tiers are associated with custom route tables, perform the following:
Remediation / Resolution
To create a custom route table and associate it with your web/app/data private subnets, perform the following:
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
You are auditing:
Create Route Table for Private Subnets
Risk level: Medium