Cis AWS Euc 2.17

Ensure WorkSpaces API requests flow through a VPC Endpoint (Automated)

Description

For any WorkSpaces API requests setup the connection through an interface endpoint in your VPC.

Rationale

Utilizing a VPC interface endpoint for WorkSpaces API requests keeps the communication within the AWS network.

Impact

This feature can only be used for connecting to WorkSpaces API endpoints.

Audit Procedure

Using AWS CLI

Perform the steps to determine if WorkSpaces is using a VPC endpoint for API:

1. Run the WorkSpaces describe-workspace-budles command:

aws workspaces describe-workspace-bundles --endpoint-url
VPC_Endpoint_ID.workspaces.Region.vpce.amazonaws.com

2. Example output of that command:

--endpoint-name Endpoint_Name
--body "Endpoint_Body"
--content-type "Content_Type"
Output_File

Confirm the --endpoint-name is equal to the VPC Endpoint that you have created. If the endpoint name does not match what you created or is blank, refer to the remediation below.

Expected Result

WorkSpaces API requests are routed through the configured VPC endpoint.

Remediation

Using AWS Console

Perform the steps below if you need to create a VPC interface endpoint.

1. Log in to the VPC console at https://console.aws.amazon.com/vpc/
2. In the left pane, click Endpoints
3. Click Create Endpoint.
4. For Service category, ensure that AWS services is selected.
5. For Service Name, choose Workspaces. For Type, ensure that it indicates Interface.
6. Complete the following information:
   • For VEC, select a VPC in which to create the endpoint.
   • For Subnets, select the subnets (Availability Zones) in which to create the endpoint network interfaces. Not all Availability Zones may be supported for all AWS services.
   • To enable private DNS for the interface endpoint, for Enable Private DNS Name, select the check box.
   • For Security group, select the security groups to associate with the endpoint network interfaces.
7. Click Create endpoint

Using AWS CLI

1. Run the create-vpc-endpoint command:

aws ec2 create-vpc-endpoint --vpc-id vpc-ec43eb89 --vpc-endpoint-type
interface --service-name com.amazonaws.us-east-1.elasticloadbalancing --
subnet-id subnet-abababab --security-group-id sg-1a2b3c4d

In the output that's returned, take note of the DnsName fields. You can use these DNS names to access the AWS service.

Next perform the steps to add the Endpoint to the WorkSpace image

Using AWS CLI

1. Run the copy-workspace-image command including the endpoint url you just created.

aws workspaces copy-workspace-image --endpoint-url
VPC_Endpoint_ID.workspaces.Region.vpce.amazonaws.com

Default Value

By default, this feature is not enabled and must be configured in the VPC console.

References

1. https://docs.aws.amazon.com/workspaces/latest/adminguide/infrastructure-security.html
2. https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint

CIS Controls

Controls Version v8:

• 3.13 Deploy a Data Loss Prevention Solution

Controls Version v7:

• 13.3 Monitor and Block Unauthorized Network Traffic

Profile

Level 1