cyberstrikeus Ensure WorkSpaces traffic is controlled and routed through a NAT Gateway (Manual)
Profile Applicability
- Level 1
Description
A network address translation (NAT) gateway enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a direct connection with those instances.
Rationale
WorkSpaces must have access to the internet so that you can install updates to the operating system and deploy applications.
Impact
None specified in the benchmark.
Audit Procedure
Using AWS Console
Perform the following steps to verify a NAT Gateway is configured and utilized:
- Login to the VPC console at https://console.aws.amazon.com/vpc/
- In the left pane, click Route Tables
- On the Route Table tab
- Select the public route table set for WorkSpaces
- Click the Subnet Associations Tab
- Confirm that the Subnet ID is set to the WorkSpaces Public subnet
- De-select the public route table and select the WorkSpaces Private route table
- Click the Subnet Associations Tab
- Confirm that the Subnet ID is set to the 2 WorkSpaces Private subnet
If the Route tables aren't set for one route for local traffic and another route that sends all other traffic to the internet gateway for the VPC refer to the remediation procedure below.
Remediation
Using AWS Console
Perform the following steps to create a NAT gateway:
Login to the VPC console at https://console.aws.amazon.com/vpc/
In the left pane, click NAT Gateways
Click Create NAT Gateway
For NAT Gateway settings:
- Name - although optional use something to identify it with WorkSpaces
- Specify the subnet in which to create the NAT gateway
- Select the Elastic IP Allocation ID
Click Create a NAT Gateway
The NAT gateway will display in the console and after a few moments, its status will change to Available.
If the NAT gateway goes to a status of Failed, there was an error during creation.
After you've created your NAT gateway, you must update your route tables for your private subnets to point internet traffic to the NAT gateway.
To create a route for a NAT gateway:
Log in to the VPC console at https://console.aws.amazon.com/vpc/
In the left pane, Click Route Tables
Select the route table associated with your private subnet
Click Routes tab
Click Edit routes
Click Add route
For Edit routes:
- Destination, enter 0.0.0.0/0
- Target, select the ID of your NAT gateway
Click Save routes
Default Value
By default, No NAT Gateways are created for a VPC.
References
- https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
- https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-vpc.html
Additional Information
Note: In some multi-account AWS architectures organizations may choose to leverage a centralized internet egress pattern. This could be due to appliances running in the centralized pattern which are being used to enforce controls and could include DLP or category filtering on internet egress traffic. In this case the relevant audit procedure is ensuring the workspaces VPC has a route to the internet (either via proxy server configuration on the workspace instances themselves or the default route on the workspace instance VPC subnet)
CIS Controls
v8:
- 3.12 Segment Data Processing and Storage Based on Sensitivity
- Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.
- 13.4 Perform Traffic Filtering Between Network Segments
- Perform traffic filtering between network segments, where appropriate.
v7:
- 14.1 Segment the Network Based on Sensitivity
- Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
- 14.2 Enable Firewall Filtering Between VLANs
- Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.