# Ensure Subnet Auto-assign Public IP Disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000218696-ensure-subnet-auto-assign-public-ip-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

The IP address enables resources in your VPC to communicate with each other, and with resources over the internet.

All subnets have an attribute that determines whether a network interface created the subnet automatically receives a public IPv4 address. Therefore, when you launch an instance into a subnet that has this attribute enabled, a public IP address is assigned to the primary network interface (eth0) that’s created for the instance. It mapped to a primary private IP address through network address translation(NAT).

  

## **Rationale:**

The subnet has an attribute that determines whether instances launched into that subnet receive a public IP address from the public IPv4 address pool.

Checks if Amazon Virtual Private Cloud (Amazon VPC) subnets are assigned a public IP address. The rule is COMPLIANT if Amazon VPC does not have subnets that are assigned a public IP address. The rule is NON\_COMPLIANT if Amazon VPC has subnets that are assigned a public IP address.

  

## **Impact:**

Automatic Public IP assignment can expose the instances within the subnet to the internet. It is recommended to disable this feature for subnets.

  

## **Default Value:**

By default Auto-assign Public IP is enabled in the subnets

  

### **Pre-Requisite:**

Before proceeding to implementation you must stop instances that are associated with the subnets.

  

## **Remediation:**

  

## **Test Plan:**

-   Login to AWS Management Console
    
-   Go to VPC dashboard at [https://console.aws.amazon.com/vpc](https://console.aws.amazon.com/vpc "https://console.aws.amazon.com/vpc")
    
-   In the left navigation pane click on **subnets** 
    
-   Select the subnet and click on **view details** in **Action** menu list  
    ![](https://support.icompaas.com/assets/kb/7543eaec9a6005c8.png)
    
-   In subnet details, you can see Auto-assign public IPv4 address is enabled or disabled with yes or no   
    ![](https://support.icompaas.com/assets/kb/479f39cf6b366899.png) 
    

  

### **Using AWS CLI:**

To describe your subnets

aws ec2 describe-subnets --region <region> 

  

### **Implementation Steps:**

-   Login to AWS Management Console
    
-   Go to VPC dashboard at [https://console.aws.amazon.com/vpc](https://console.aws.amazon.com/vpc "https://console.aws.amazon.com/vpc")
    
-   click on **subnets** in the left navigation pane  
    ![](https://support.icompaas.com/assets/kb/7c04c46f1e5de2be.png)
    
-   Select the subnet to disable auto-assign public IP  
-   Click on the **Actions** button and select **Modify auto-assign IP settings**  
    **![](https://support.icompaas.com/assets/kb/d501dd4c2d011213.png)**
-   **Uncheck the **Enable auto-assign public IPv4 address** checkBox to disable the auto-assign public IPv4 address to the subnet**  
    **![](https://support.icompaas.com/assets/kb/a315a2d001fa27a6.png)**
-   **Click on the **Save** button**

  

### **Using AWS CLI:**

To change a subnet's public IPv4 addressing behavior

aws ec2 modify-subnet-attribute --subnet-id subnet-1a2b3c4d --no-map-public-ip-on-launch

  

## **Backout Plan:**

-   Login to AWS Management Console
    
-   Go to VPC dashboard at [https://console.aws.amazon.com/vpc](https://console.aws.amazon.com/vpc "https://console.aws.amazon.com/vpc")
    
-   click on **subnets** in the left navigation pane 
    
-   Select the subnet to enable auto-assign public IP  
    
-   Click on the **Actions** button and select **Modify auto-assign IP settings** 
    
-   Check the  **Enable auto-assign public IPv4 address** checkBox to enable the auto-assign public IPv4 address and click on the **Save** button.
    

  

### **Using AWS CLI:**

To change a subnet's public IPv4 addressing behavior

aws ec2 modify-subnet-attribute --subnet-id subnet-1a2b3c4d --map-public-ip-on-launch

  

## **Reference:**

1.  [![](https://support.icompaas.com/assets/kb/2eff5b302048274c.png)](https://docs.aws.amazon.com/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.html)[subnet-auto-assign-public-ip-disabled - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.html) 
    
2.  [![](https://support.icompaas.com/assets/kb/4aa65c883310d7dd.png)](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html)[IP Addressing in your VPC - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.