Overview
A Config rule that checks whether Amazon Elastic Compute Cloud (Amazon EC2) instances have a public IP association. The rule is NON_COMPLIANT if the publicIp field is present in the Amazon EC2 instance configuration item. This rule applies only to IPv4
This config rule supports Auto Remediation actions using SSM Automation triggered with CloudWatch Events. The following actions are supported:
- Stop Instance: Non-compliant instances are stopped.
- Terminate Instance: Non-compliant instances are terminated. (Be careful when selecting this option to not accidentally terminate existing resources).
In addition to an action, a notification using an SNS Topic can be added to send a custom message when a non-compliant resource is detected. (Make sure to update the email address from the default email@example.com)
Configuration Templates
Items
1
Size
0.7 KB
AWSTemplateFormatVersion: '2010-09-09'
Description: ''
Resources:
ConfigRule:
Type: 'AWS::Config::ConfigRule'
Properties:
ConfigRuleName: ec2-instance-no-public-ip
Description: >-
A Config rule that checks whether Amazon Elastic Compute Cloud (Amazon
EC2) instances have a public IP association. The rule is NON_COMPLIANT
if the publicIp field is present in the Amazon EC2 instance
configuration item. This rule applies only to IPv4
Scope:
ComplianceResourceTypes:
- 'AWS::EC2::Instance'
Source:
Owner: AWS
SourceIdentifier: EC2_INSTANCE_NO_PUBLIC_IP
Parameters: {}
Metadata: {}
Conditions: {}
Actions
Sources and Documentation
Configuration Source: AWS Documentation
Additional Documentation:
- AWS Documentation: Setting up AWS Config Managed Rules
- AWS Documentation: AWS Config Managed Rules Overview
- CloudFormation Reference Guide: Create an AWS Config Rule
- AWS CLI Command Reference Guide: Create an AWS Config Rule