All checks
Medium
EC2 VPC Block Public Access settings should block internet gateway traffic
Verifies that VPC Block Public Access is on in this Region in Bidirectional or Ingress-only mode. It is one switch per account and Region that blocks internet gateway traffic to the Region's VPCs whatever their route tables, security groups and network ACLs allow, except for the VPCs and subnets you exclude.
- service
- EC2
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: Internet-facing load balancers, bastions and, in Bidirectional mode, NAT gateways lose internet traffic once it takes effect, so create exclusions for whatever must stay reachable first.
In the console
VPC → Settings → Block public access → Edit public access settings
- Turn on block public access
- Selected
- Internet gateway block direction
- Ingress-only to keep outbound access through NAT gateways, or Bidirectional (what the CLI and Terraform routes set)
With the AWS CLI
aws ec2 modify-vpc-block-public-access-options --internet-gateway-block-mode block-bidirectional --region <region>With Terraform
resource "aws_vpc_block_public_access_options" "this" {
internet_gateway_block_mode = "block-bidirectional"
}See which of your accounts this check is failing on.
Book a live scan