6.15 Ensure Routing Table associated with App tier subnet have the default route (0.0.0.0/0) defined to allow connectivity

Information

A _route table_ contains a set of rules, called _routes_, that are used to determine where network traffic is directed.

Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table.
The default route (0.0.0.0/0) should be pointing to the NAT Gateway in order to provide internet connectivity for the App tier instances.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Using the Amazon unified command line interface:

* For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:

* aws ec2 replace-route --route-table-id _<route_table_id>_ --destination-cidr-block 0.0.0.0/0 --gateway-id _<vpc_nat_gw>_



* For the above route tables, if the default route (0.0.0.0/0) doesn't exist:

* aws ec2 create-route --route-table-id _<route_table_id>_ --destination-cidr-block 0.0.0.0/0 --gateway-id _<vpc_nat_gw>_

See Also

https://workbench.cisecurity.org/files/260

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(15)

Plugin: amazon_aws

Control ID: 4ecbd3d03f8c3c358786d49cf6431d87297261f31f690c46f5a6bb5b41aba247