Cloud Config:vpc-routetable-destination-cidr-check

Scenarios

Custom route tables let you route traffic to specific destinations. If 0.0.0.0/0 is added as the destination CIDR block of a custom route, the route table allows access from all IP addresses over the Internet, which poses significant security risks. Proceed with caution.

Risk level

Default risk level: high.

When you apply this rule, you can change the risk level based on your business requirements.

Compliance evaluation logic

If the destination CIDR block of the custom routes in a VPC route table is not set to all CIDR blocks, the evaluation result is Compliant.

Rule details

Parameter	Description
Rule Template Name	vpc-routetable-destination-cidr-check
Rule Template Identifier	vpc-routetable-destination-cidr-check
Tag	RouteTable
Automatic remediation	Not supported
Invoke Type	Configuration Change
Supported resource type	VPC route table (ACS::VPC::RouteTable)
Input parameter	N/A

Non-compliance remediation

Change the destination CIDR block of the custom routes in a VPC route table to a value other than 0.0.0.0/0. For more information, see Create and manage a route table.