A VPC custom CIDR block is Compliant if at least one route entry for its IP addresses exists in the associated route table.
Scenarios
Identifies unused custom CIDR blocks so you can remove them and reduce management overhead from invalid configurations.
Risk level
Default risk level: high.
You can change the risk level when you apply this rule.
Compliance evaluation logic
- If the associated route table contains at least one route entry for an IP address within the custom CIDR block, the result is Compliant.
- If the associated route table contains no route entry for any IP address within the custom CIDR block, the result is Incompliant. Remediate the configuration by following Incompliance remediation.
Rule details
| Item | Description |
| Rule name | vpc-secondary-cidr-route-check |
| Rule identifier | vpc-secondary-cidr-route-check |
| Tag | VPC and RouteTable |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Every 24 hours |
| Supported resource type | VPC |
| Input parameter | None. |
Incompliance remediation
Create a custom route table. For more information, see Create and manage a route table.