AnalysisType: policy
Filename: aws_ec2_instance_approved_vpc.py
PolicyID: "AWS.EC2.Instance.ApprovedVPC"
DisplayName: "AWS EC2 Instance Approved VPC"
Enabled: false
ResourceTypes:
- AWS.EC2.Instance
Tags:
- AWS
- Configuration Required
Severity: High
Description: >
This policy ensures that the given EC2 Instance is running in an approved VPC.
Runbook: >
https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-ec2-instance-running-in-approved-vpc
Reference: https://aws.amazon.com/vpc/
Tests:
- Name: Instance Not Running In Approved VPC
ExpectedResult: false
Resource:
{
"AmiLaunchIndex": 0,
"Architecture": "x86_64",
"BlockDeviceMappings":
[
{
"DeviceName": "/dev/xvda",
"Ebs":
{
"AttachTime": "2019-01-01T00:00:00Z",
"DeleteOnTermination": true,
"Status": "attached",
"VolumeId": "vol-0b111222333444",
},
},
],
"CapacityReservationId": null,
"CapacityReservationSpecification":
{
"CapacityReservationPreference": "open",
"CapacityReservationTarget": null,
},
"ClientToken": null,
"CpuOptions": { "CoreCount": 1, "ThreadsPerCore": 1 },
"EbsOptimized": false,
"ElasticGpuAssociations": null,
"ElasticInferenceAcceleratorAssociations": null,
"EnaSupport": true,
"HibernationOptions": { "Configured": false },
"Hypervisor": "xen",
"IamInstanceProfile": null,
"ImageId": "ami-11122233344555",
"InstanceId": "i-111222333444555",
"InstanceLifecycle": null,
"InstanceType": "t2.micro",
"KernelId": null,
"KeyName": "key-1",
"LaunchTime": "2019-01-01T00:00:00Z",
"Licenses": null,
"Monitoring": { "State": "disabled" },
"NetworkInterfaces":
[
{
"Association":
{
"IpOwnerId": "amazon",
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIp": "52.0.0.0",
},
"Attachment":
{
"AttachTime": "2019-01-01T00:00:00Z",
"AttachmentId": "eni-attach-111222333444",
"DeleteOnTermination": true,
"DeviceIndex": 0,
"Status": "attached",
},
"Description": "Primary network interface",
"Groups": [{ "GroupId": "sg-111222333444", "GroupName": "base" }],
"InterfaceType": "interface",
"Ipv6Addresses": null,
"MacAddress": "de:ad:be:ef:00:00",
"NetworkInterfaceId": "eni-111222333444",
"OwnerId": "123456789012",
"PrivateDnsName": "ip-10-0-0-0.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
"PrivateIpAddresses":
[
{
"Association":
{
"IpOwnerId": "amazon",
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIp": "52.0.0.0",
},
"Primary": true,
"PrivateDnsName": "ip-10-0-0-o.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
},
],
"SourceDestCheck": true,
"Status": "in-use",
"SubnetId": "subnet-111222333444",
"VpcId": "vpc-111222333444",
},
],
"Placement":
{
"Affinity": null,
"AvailabilityZone": "us-west-2b",
"GroupName": null,
"HostId": null,
"PartitionNumber": null,
"SpreadDomain": null,
"Tenancy": "default",
},
"Platform": null,
"PrivateDnsName": "ip-10-0-0-0.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
"ProductCodes": null,
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIpAddress": "52.0.0.0",
"RamdiskId": null,
"RootDeviceName": "/dev/xvda",
"RootDeviceType": "ebs",
"SecurityGroups":
[{ "GroupId": "sg-111222333444", "GroupName": "base" }],
"SourceDestCheck": true,
"SpotInstanceRequestId": null,
"SriovNetSupport": null,
"State": { "Code": 16, "Name": "running" },
"StateReason": null,
"StateTransitionReason": null,
"SubnetId": "subnet-111222333",
"Tags": { "TagOne": "True" },
"VirtualizationType": "hvm",
"Volumes":
[
{
"Attachments":
[
{
"AttachTime": "2019-01-01T00:00:00Z",
"DeleteOnTermination": true,
"Device": "/dev/xvda",
"InstanceId": "i-111222333",
"State": "attached",
"VolumeId": "vol-111222333",
},
],
"AvailabilityZone": "us-west-2b",
"CreateTime": "2019-01-01T00:00:00Z",
"Encrypted": false,
"Iops": 100,
"KmsKeyId": null,
"Size": 8,
"SnapshotId": "snap-111222333444",
"State": "in-use",
"Tags": { "TagOne": "True" },
"VolumeId": "vol-111222333444",
"VolumeType": "gp2",
},
],
"VpcId": "vpc-111222333444",
}
- Name: Instance Not Running In Approved VPC But Exempted From Rule
ExpectedResult: true
Resource:
{
"AmiLaunchIndex": 0,
"Architecture": "x86_64",
"BlockDeviceMappings":
[
{
"DeviceName": "/dev/xvda",
"Ebs":
{
"AttachTime": "2019-01-01T00:00:00Z",
"DeleteOnTermination": true,
"Status": "attached",
"VolumeId": "vol-0b111222333444",
},
},
],
"CapacityReservationId": null,
"CapacityReservationSpecification":
{
"CapacityReservationPreference": "open",
"CapacityReservationTarget": null,
},
"ClientToken": null,
"CpuOptions": { "CoreCount": 1, "ThreadsPerCore": 1 },
"EbsOptimized": false,
"ElasticGpuAssociations": null,
"ElasticInferenceAcceleratorAssociations": null,
"EnaSupport": true,
"HibernationOptions": { "Configured": false },
"Hypervisor": "xen",
"IamInstanceProfile": null,
"ImageId": "ami-11122233344555",
"InstanceId": "i-111222333444555",
"InstanceLifecycle": null,
"InstanceType": "t2.micro",
"KernelId": null,
"KeyName": "key-1",
"LaunchTime": "2019-01-01T00:00:00Z",
"Licenses": null,
"Monitoring": { "State": "disabled" },
"NetworkInterfaces":
[
{
"Association":
{
"IpOwnerId": "amazon",
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIp": "52.0.0.0",
},
"Attachment":
{
"AttachTime": "2019-01-01T00:00:00Z",
"AttachmentId": "eni-attach-111222333444",
"DeleteOnTermination": true,
"DeviceIndex": 0,
"Status": "attached",
},
"Description": "Primary network interface",
"Groups": [{ "GroupId": "sg-111222333444", "GroupName": "base" }],
"InterfaceType": "interface",
"Ipv6Addresses": null,
"MacAddress": "de:ad:be:ef:00:00",
"NetworkInterfaceId": "eni-111222333444",
"OwnerId": "123456789012",
"PrivateDnsName": "ip-10-0-0-0.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
"PrivateIpAddresses":
[
{
"Association":
{
"IpOwnerId": "amazon",
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIp": "52.0.0.0",
},
"Primary": true,
"PrivateDnsName": "ip-10-0-0-o.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
},
],
"SourceDestCheck": true,
"Status": "in-use",
"SubnetId": "subnet-111222333444",
"VpcId": "vpc-111222333444",
},
],
"Placement":
{
"Affinity": null,
"AvailabilityZone": "us-west-2b",
"GroupName": null,
"HostId": null,
"PartitionNumber": null,
"SpreadDomain": null,
"Tenancy": "default",
},
"Platform": null,
"PrivateDnsName": "ip-10-0-0-0.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
"ProductCodes": null,
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIpAddress": "52.0.0.0",
"RamdiskId": null,
"RootDeviceName": "/dev/xvda",
"RootDeviceType": "ebs",
"SecurityGroups":
[{ "GroupId": "sg-111222333444", "GroupName": "base" }],
"SourceDestCheck": true,
"SpotInstanceRequestId": null,
"SriovNetSupport": null,
"State": { "Code": 16, "Name": "running" },
"StateReason": null,
"StateTransitionReason": null,
"SubnetId": "subnet-111222333",
"Tags": { "KeyOne": "ValueOne" },
"VirtualizationType": "hvm",
"Volumes":
[
{
"Attachments":
[
{
"AttachTime": "2019-01-01T00:00:00Z",
"DeleteOnTermination": true,
"Device": "/dev/xvda",
"InstanceId": "i-111222333",
"State": "attached",
"VolumeId": "vol-111222333",
},
],
"AvailabilityZone": "us-west-2b",
"CreateTime": "2019-01-01T00:00:00Z",
"Encrypted": false,
"Iops": 100,
"KmsKeyId": null,
"Size": 8,
"SnapshotId": "snap-111222333444",
"State": "in-use",
"Tags": { "KeyOne": "ValueOne" },
"VolumeId": "vol-111222333444",
"VolumeType": "gp2",
},
],
"VpcId": "vpc-111222333444",
}
- Name: Instance Running In Approved VPC
ExpectedResult: true
Resource:
{
"AmiLaunchIndex": 0,
"Architecture": "x86_64",
"BlockDeviceMappings":
[
{
"DeviceName": "/dev/xvda",
"Ebs":
{
"AttachTime": "2019-01-01T00:00:00Z",
"DeleteOnTermination": true,
"Status": "attached",
"VolumeId": "vol-0b111222333444",
},
},
],
"CapacityReservationId": null,
"CapacityReservationSpecification":
{
"CapacityReservationPreference": "open",
"CapacityReservationTarget": null,
},
"ClientToken": null,
"CpuOptions": { "CoreCount": 1, "ThreadsPerCore": 1 },
"EbsOptimized": false,
"ElasticGpuAssociations": null,
"ElasticInferenceAcceleratorAssociations": null,
"EnaSupport": true,
"HibernationOptions": { "Configured": false },
"Hypervisor": "xen",
"IamInstanceProfile": null,
"ImageId": "ami-11122233344555",
"InstanceId": "i-111222333444555",
"InstanceLifecycle": null,
"InstanceType": "t2.micro",
"KernelId": null,
"KeyName": "key-1",
"LaunchTime": "2019-01-01T00:00:00Z",
"Licenses": null,
"Monitoring": { "State": "disabled" },
"NetworkInterfaces":
[
{
"Association":
{
"IpOwnerId": "amazon",
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIp": "52.0.0.0",
},
"Attachment":
{
"AttachTime": "2019-01-01T00:00:00Z",
"AttachmentId": "eni-attach-111222333444",
"DeleteOnTermination": true,
"DeviceIndex": 0,
"Status": "attached",
},
"Description": "Primary network interface",
"Groups": [{ "GroupId": "sg-111222333444", "GroupName": "base" }],
"InterfaceType": "interface",
"Ipv6Addresses": null,
"MacAddress": "de:ad:be:ef:00:00",
"NetworkInterfaceId": "eni-111222333444",
"OwnerId": "123456789012",
"PrivateDnsName": "ip-10-0-0-0.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
"PrivateIpAddresses":
[
{
"Association":
{
"IpOwnerId": "amazon",
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIp": "52.0.0.0",
},
"Primary": true,
"PrivateDnsName": "ip-10-0-0-o.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
},
],
"SourceDestCheck": true,
"Status": "in-use",
"SubnetId": "subnet-111222333444",
"VpcId": "vpc-111222333444",
},
],
"Placement":
{
"Affinity": null,
"AvailabilityZone": "us-west-2b",
"GroupName": null,
"HostId": null,
"PartitionNumber": null,
"SpreadDomain": null,
"Tenancy": "default",
},
"Platform": null,
"PrivateDnsName": "ip-10-0-0-0.us-west-2.compute.internal",
"PrivateIpAddress": "10.0.0.0",
"ProductCodes": null,
"PublicDnsName": "ec2-52-0-0-0.us-west-2.compute.amazonaws.com",
"PublicIpAddress": "52.0.0.0",
"RamdiskId": null,
"RootDeviceName": "/dev/xvda",
"RootDeviceType": "ebs",
"SecurityGroups":
[{ "GroupId": "sg-111222333444", "GroupName": "base" }],
"SourceDestCheck": true,
"SpotInstanceRequestId": null,
"SriovNetSupport": null,
"State": { "Code": 16, "Name": "running" },
"StateReason": null,
"StateTransitionReason": null,
"SubnetId": "subnet-111222333",
"Tags": { "TagOne": "True" },
"VirtualizationType": "hvm",
"Volumes":
[
{
"Attachments":
[
{
"AttachTime": "2019-01-01T00:00:00Z",
"DeleteOnTermination": true,
"Device": "/dev/xvda",
"InstanceId": "i-111222333",
"State": "attached",
"VolumeId": "vol-111222333",
},
],
"AvailabilityZone": "us-west-2b",
"CreateTime": "2019-01-01T00:00:00Z",
"Encrypted": false,
"Iops": 100,
"KmsKeyId": null,
"Size": 8,
"SnapshotId": "snap-111222333444",
"State": "in-use",
"Tags": { "TagOne": "True" },
"VolumeId": "vol-111222333444",
"VolumeType": "gp2",
},
],
"VpcId": "EXAMPLE-VPC-ID",
}
# ------ paired body: aws_ec2_instance_approved_vpc.py ------
# Tags: ['AWS Managed Rules - Compute']
# This is a list of approved VPC IDs. All EC2 instances must exist in one of these VPCs.
APPROVED_VPCS = {
"EXAMPLE-VPC-ID",
}
# IGNORED_INSTANCE_TAGS is to describe tags that, if present on an EC2 instance, indicate that the
# instance is to be exempted from this rule.
# Example: IGNORED_INSTANCE_TAGS = {'KeyOne': 'ValueOne', 'KeyTwo': 'ValueTwo'}
IGNORED_INSTANCE_TAGS = {
"KeyOne": "ValueOne",
}
def policy(resource):
# Check if any tags on this EC2 instance make it exempt from this rule
if resource["Tags"] is not None:
tags = resource.get("Tags", {})
for tag in tags:
if tag in IGNORED_INSTANCE_TAGS.keys():
if isinstance(IGNORED_INSTANCE_TAGS[tag], str):
if tags[tag] == IGNORED_INSTANCE_TAGS[tag]:
return True
elif isinstance(IGNORED_INSTANCE_TAGS[tag], list):
if tags[tag] in IGNORED_INSTANCE_TAGS[tag]:
return True
return resource["VpcId"] in APPROVED_VPCS