OpenParable
Skip to content
← Back to skills

Cis AWS Euc 2.5

DevOps & Security
cis-aws-euc-2.5

Cis AWS Euc 2.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure WorkSpaces traffic is controlled and routed through a NAT Gateway

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_End_User_Compute_Services_Benchmark_v1.2.0/cis-aws-euc-2.5/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-euc-2-5, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure WorkSpaces traffic is controlled and routed through a NAT Gateway (Manual)

Profile Applicability

  • Level 1

Description

A network address translation (NAT) gateway enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a direct connection with those instances.

Rationale

WorkSpaces must have access to the internet so that you can install updates to the operating system and deploy applications.

Impact

None specified in the benchmark.

Audit Procedure

Using AWS Console

Perform the following steps to verify a NAT Gateway is configured and utilized:

  1. Login to the VPC console at https://console.aws.amazon.com/vpc/
  2. In the left pane, click Route Tables
  3. On the Route Table tab
  4. Select the public route table set for WorkSpaces
  5. Click the Subnet Associations Tab
  6. Confirm that the Subnet ID is set to the WorkSpaces Public subnet
  7. De-select the public route table and select the WorkSpaces Private route table
  8. Click the Subnet Associations Tab
  9. Confirm that the Subnet ID is set to the 2 WorkSpaces Private subnet

If the Route tables aren't set for one route for local traffic and another route that sends all other traffic to the internet gateway for the VPC refer to the remediation procedure below.

Remediation

Using AWS Console

Perform the following steps to create a NAT gateway:

  1. Login to the VPC console at https://console.aws.amazon.com/vpc/

  2. In the left pane, click NAT Gateways

  3. Click Create NAT Gateway

  4. For NAT Gateway settings:

    • Name - although optional use something to identify it with WorkSpaces
    • Specify the subnet in which to create the NAT gateway
    • Select the Elastic IP Allocation ID

  5. Click Create a NAT Gateway

The NAT gateway will display in the console and after a few moments, its status will change to Available.

If the NAT gateway goes to a status of Failed, there was an error during creation.

After you've created your NAT gateway, you must update your route tables for your private subnets to point internet traffic to the NAT gateway.

To create a route for a NAT gateway:

  1. Log in to the VPC console at https://console.aws.amazon.com/vpc/

  2. In the left pane, Click Route Tables

  3. Select the route table associated with your private subnet

  4. Click Routes tab

  5. Click Edit routes

  6. Click Add route

  7. For Edit routes:

    • Destination, enter 0.0.0.0/0
    • Target, select the ID of your NAT gateway

  8. Click Save routes

Default Value

By default, No NAT Gateways are created for a VPC.

References

  1. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
  2. https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-vpc.html

Additional Information

Note: In some multi-account AWS architectures organizations may choose to leverage a centralized internet egress pattern. This could be due to appliances running in the centralized pattern which are being used to enforce controls and could include DLP or category filtering on internet egress traffic. In this case the relevant audit procedure is ensuring the workspaces VPC has a route to the internet (either via proxy server configuration on the workspace instances themselves or the default route on the workspace instance VPC subnet)

CIS Controls

v8:

  • 3.12 Segment Data Processing and Storage Based on Sensitivity
    • Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.
  • 13.4 Perform Traffic Filtering Between Network Segments
    • Perform traffic filtering between network segments, where appropriate.

v7:

  • 14.1 Segment the Network Based on Sensitivity
    • Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
  • 14.2 Enable Firewall Filtering Between VLANs
    • Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.