All checks
Medium
EC2 network interfaces should have source/destination checking enabled
Verifies that source/destination checking is enabled on user-managed EC2 network interfaces, so each handles only traffic it sends or receives itself. With it off, the interface can spoof source addresses or relay traffic between networks; a NAT instance that needs it off can be replaced by a NAT gateway.
- service
- EC2
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: A NAT instance, software router or firewall appliance behind this interface stops forwarding traffic at once, so find out what turned the check off before enabling it.
In the console
EC2 → Network Interfaces → the interface → Actions → Change source/dest check
- Source/destination check
- Enable
With the AWS CLI
aws ec2 modify-network-interface-attribute --network-interface-id <network-interface-id> --source-dest-check Value=true --region <region>With Terraform
resource "aws_network_interface" "this" {
subnet_id = var.subnet_id
source_dest_check = true
}See which of your accounts this check is failing on.
Book a live scan