Assigning public IP addresses expose your instances to public internet
| Severity | Exploitability | Providers | Categories |
|---|---|---|---|
| HIGH | MEDIUM | AWS | NETWORK |
Description#
A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances.
Associating a public IP address to these instances will expose them to the public internet. Note that if your instances are spawned in a public Virtual Private Cloud, a public IP address will be assigned to them even if you switch off the associate_public_ip_address_setting in the launch group configuration.
Impact#
| Potential data exposure | Visible in logs | User interaction required | Privileges required |
|---|---|---|---|
| True | True | False | False |
Having open ingress means anyone can try and connect to the asset.
- If credentials are required to establish a connection, it still leaves open the possibility to bruteforce the credentials, or perform Denial of Service attacks.
- If no credentials are required, or credentials have been acquired by an attacker, then the asset is fully compromised.
Remediation guidelines#
- Modify the launch configuration to disable the public IP address association.
- Terminate and recreate the existing instances that were launched with this configuratio, so that the new parameters are taken into account.