# Cis AWS Euc 5.2

> Cis AWS Euc 5.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure a VPC Endpoint is set for AppStream

- Skill name: `cis-aws-euc-5.2`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_End_User_Compute_Services_Benchmark_v1.2.0/cis-aws-euc-5.2/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure a VPC Endpoint is set for AppStream (Manual)

## Profile Applicability

- Level 1

## Description

When you select Using a VPC endpoint, this allows users to only stream from this AppStream 2.0 stack when they have network access to the VPC.

## Rationale

Virtual Private Cloud (VPC) endpoints allow your users to stream from AppStream 2.0 through your VPC. You can create a VPC endpoint in the VPC of your choosing, then use the endpoint with AppStream 2.0 VPC to maintain the streaming traffic within the VPC.

## Impact

None - this is a security best practice.

## Audit Procedure

Perform the steps to review the interface endpoint set for AppStream 2.0.

### Using AWS Console

1. Log in to the AppStream 2.0 console at `https://console.aws.amazon.com/appstream2`
2. In the left pane, click **Stacks**, click the link for the stack you wish to view
3. Scroll to the **VPC Endpoints** section
4. Confirm the Streaming Endpoint listed is the endpoint through which to stream traffic

If there is no Streaming endpoint pointing to a specific VPC Endpoint and it is labeled as Internet refer to the remediation below.

### Using AWS CLI

Not applicable - must be audited via Console.

## Expected Result

AppStream stack has a VPC Endpoint configured for streaming traffic.

## Remediation

### Using AWS Console

Perform the following steps to create an interface endpoint:

1. Log in to the VPC console at `https://console.aws.amazon.com/vpc/`
2. In the left pane, click **Endpoints**, **Create Endpoint**
3. Click **Create Endpoint**
4. Configure the endpoint:
   - For Service category, ensure that **AWS services** is selected
   - For Service Name, choose `com.amazonaws.<AWS Region>.appstream.streaming`
   - For VPC, choose a VPC in which to create the interface endpoint
   - For Subnets, choose the subnet (Availability Zone) in which to create the endpoint network interfaces
   - Ensure that the **Enable Private DNS Name** check box is selected
   - For Security group, select the security group for AppStream
5. Click **Create endpoint**

**To update a stack to use a new interface endpoint:**

1. Log in to AppStream 2.0 console at `https://console.aws.amazon.com/appstream2`
2. In the left pane, click **Stacks**, and click the link of the stack name wish to edit
3. Scroll to the **VPC Endpoints**, and then choose **Edit**
4. In the Edit VPC Endpoint dialog box, for Streaming Endpoint, choose the endpoint you just created
5. Click **Save Changes**

Traffic for new streaming sessions will be routed through this endpoint. However, traffic for current streaming sessions continues to be routed through the previously specified endpoint.

### Using AWS CLI

Not applicable - must be configured via Console.

## Default Value

By default, VPC endpoints must be manually configured.

## References

1. https://docs.aws.amazon.com/appstream2/latest/developerguide/creating-streaming-from-interface-vpc-endpoints.html

## CIS Controls

**v8:**

- 3.12 Segment Data Processing and Storage Based on Sensitivity
  - Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.

**v7:**

- 14.1 Segment the Network Based on Sensitivity
  - Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).

## Profile

Level 1

---

Source: https://www.openparable.com/skill/devops-security/cis-aws-euc-5-2 (OpenParable). Cite the canonical URL above.