VPC Endpoint Should Be Enabled For DynamoDB
More Info:
A VPC endpoint for DynamoDB enables Amazon EC2 instances in your VPC to use their private IP addresses to access DynamoDB with no exposure to the public internet. Your EC2 instances do not require public IP addresses, and you do not need an internet gateway, a NAT device, or a virtual private gateway in your VPC.Risk Level
MediumAddress
SecurityCompliance Standards
HIPAATriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of VPC Endpoint not being enabled for DynamoDB in AWS, you can follow these steps using the AWS Management Console:
-
Sign in to the AWS Management Console:
- Go to the AWS Management Console (https://aws.amazon.com/console/) and sign in to your AWS account.
-
Navigate to the VPC service:
- In the AWS Management Console, search for “VPC” or locate the VPC service under the “Networking & Content Delivery” section.
-
Create a VPC Endpoint for DynamoDB:
- In the VPC dashboard, click on “Endpoints” in the left-hand menu.
- Click on the “Create Endpoint” button.
- For the service category, select “AWS services”.
- For the service name, select
com.amazonaws.<region>.dynamodb(replace<region>with the AWS region where your DynamoDB table is located). - For the VPC, select the VPC where your resources that need to access DynamoDB are located.
- Select the route table associated with your VPC.
- Choose whether to enable DNS name resolution for the endpoint.
- Click on the “Create endpoint” button.
-
Update Security Group Rules (if necessary):
- If your resources are in a different security group than the DynamoDB endpoint, ensure that the security group rules allow traffic between the two.
-
Verify the Endpoint Configuration:
- Once the endpoint is created, verify that it is in the “available” state.
-
Update the Route Tables (if necessary):
- If the route tables in your VPC are not updated automatically, you may need to add a route to the DynamoDB VPC endpoint in the route tables associated with your subnets.
Using CLI
Using CLI
To remediate the misconfiguration of not having a VPC Endpoint enabled for DynamoDB in AWS using AWS CLI, you can follow these steps:
-
Create a VPC Endpoint for DynamoDB:
Run the following AWS CLI command to create a VPC endpoint for DynamoDB in your VPC. Replace the placeholders
<vpc-id>with your VPC ID and<region>with the AWS region where your VPC is located. -
Enable DNS Support and DNS Hostnames for the VPC:
Ensure that your VPC has DNS support and DNS hostnames enabled. Run the following AWS CLI commands to enable them:
-
Update Route Tables:
Update the route tables associated with your VPC to route traffic to the DynamoDB VPC endpoint. Run the following AWS CLI command to get the route table IDs associated with your VPC:
For each route table ID obtained from the above command, run the following AWS CLI command to add a route to the DynamoDB VPC endpoint:
-
Verify the Configuration:
You can verify that the VPC endpoint for DynamoDB is successfully created and associated with your VPC by running the following AWS CLI command:
Using Python
Using Python
To remediate the misconfiguration of not having a VPC Endpoint enabled for DynamoDB in AWS using Python, you can follow these steps:Replace By following these steps and executing the Python script, you will be able to remediate the misconfiguration of not having a VPC Endpoint enabled for DynamoDB in AWS.
- Import the necessary libraries:
- Create a boto3 client for EC2 and DynamoDB:
- Get the VPC ID where your DynamoDB table is located:
- Create a VPC endpoint for DynamoDB:
REGION, YOUR_TABLE_NAME, YOUR_ROUTE_TABLE_ID, and YOUR_SECURITY_GROUP_ID with your actual values.- Verify that the VPC endpoint is created successfully: