Profile Applicability:
- Level 1
Description:
Creating a Virtual Private Cloud (VPC) allows you to launch AWS resources in a logically isolated network. It provides complete control over networking configurations, such as subnets, IP ranges, route tables, and security groups.
Rationale:
By using a VPC, you can isolate databases from the public internet, control traffic at the subnet level, and enforce network segmentation. This is a critical foundational step in secure AWS deployments, particularly for database services.
Impact:
Pros:
Improved network security and isolation
Better control over traffic routing and firewall rules
Supports high availability and disaster recovery setups
Cons:
Misconfigured settings can lead to unintentional exposure or blocked communication
Additional planning required for IP addressing and subnet layout
Default Value:
No VPC is created by default for your database; it must be configured manually or during service provisioning.
Pre-requisites:
AWS account with required IAM permissions
Subnet and CIDR planning
Optional: knowledge of Internet Gateway, NAT, and route tables
Remediation:
Test Plan
Using AWS Console:
Sign in to the AWS Management Console
Navigate to VPC Dashboard
Click on Your VPCs and confirm a VPC is created with a valid CIDR range
Ensure subnets are present and belong to the VPC
Confirm security groups and route tables are configured properly
Check that database services (RDS, DocumentDB) are deployed in the selected VPC
Using AWS CLI:
List existing VPCs:
aws ec2 describe-vpcs
List subnets in a VPC:
aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpc-id>
List security groups in a VPC:
aws ec2 describe-security-groups --filters Name=vpc-id,Values=<vpc-id>
Implementation Plan
Using AWS Console:
Sign in to the AWS Console
Go to VPC > Create VPC
Choose VPC only or VPC and more
Enter a name and a CIDR block (e.g., 10.0.0.0/16)
Click Create VPC
Navigate to Subnets > Create subnet
Select the VPC and specify subnet details (name, AZ, CIDR)
Go to Security Groups > Create security group
Assign the security group to the VPC and define inbound/outbound rules
Attach this VPC during database creation
Using AWS CLI:
Create a VPC:
aws ec2 create-vpc --cidr-block 10.0.0.0/16
Create a subnet:
aws ec2 create-subnet --vpc-id <vpc-id> --cidr-block 10.0.1.0/24 --availability-zone us-east-1a
Create a security group:
aws ec2 create-security-group --group-name MyDBSG --description "DB access group" --vpc-id <vpc-id>
Authorize inbound access to the database port:
aws ec2 authorize-security-group-ingress --group-id <sg-id> --protocol tcp --port 3306 --cidr <your-ip>/32
(Optional) Authorize outbound traffic:
aws ec2 authorize-security-group-egress --group-id <sg-id> --protocol -1 --port all --cidr 0.0.0.0/0
Backout Plan
Using AWS Console:
Go to VPC Dashboard > Subnets, select and delete subnets
Go to Security Groups, select and delete the group
Go to Your VPCs, select and delete the VPC
Using AWS CLI:
Delete the security group:
aws ec2 delete-security-group --group-id <sg-id>
Delete the subnet:
aws ec2 delete-subnet --subnet-id <subnet-id>
Delete the VPC:
aws ec2 delete-vpc --vpc-id <vpc-id>
References:
CIS AWS Database Services Benchmark v1.0.0, Section 3.3