Overview

A Config rule that checks whether Amazon Elastic Compute Cloud (Amazon EC2) instances have a public IP association. The rule is NON_COMPLIANT if the publicIp field is present in the Amazon EC2 instance configuration item. This rule applies only to IPv4

This config rule supports Auto Remediation actions using SSM Automation triggered with CloudWatch Events. The following actions are supported:

  • Stop Instance: Non-compliant instances are stopped.
  • Terminate Instance: Non-compliant instances are terminated. (Be careful when selecting this option to not accidentally terminate existing resources).

In addition to an action, a notification using an SNS Topic can be added to send a custom message when a non-compliant resource is detected. (Make sure to update the email address from the default email@example.com)

Configuration Templates

Items
1
Size
0.7 KB
AWSTemplateFormatVersion: '2010-09-09'
Description: ''
Resources:
  ConfigRule:
    Type: 'AWS::Config::ConfigRule'
    Properties:
      ConfigRuleName: ec2-instance-no-public-ip
      Description: >-
        A Config rule that checks whether Amazon Elastic Compute Cloud (Amazon
        EC2) instances have a public IP association. The rule is NON_COMPLIANT
        if the publicIp field is present in the Amazon EC2 instance
        configuration item. This rule applies only to IPv4
      Scope:
        ComplianceResourceTypes:
          - 'AWS::EC2::Instance'
      Source:
        Owner: AWS
        SourceIdentifier: EC2_INSTANCE_NO_PUBLIC_IP
Parameters: {}
Metadata: {}
Conditions: {}

Actions



Rule Parameters

No rule paramters
 
  
* Required field

Sources and Documentation

Configuration Source: AWS Documentation

Additional Documentation: