Homepage

Address source/destination check is disabled on the instance Affecting EC2 service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Network/ Settings

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00705
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Instances should send and receive traffic with their own IP address only. Disabling this check allows the instance to spoof other devices on the local network or intercept traffic. Ignore this issue if you are deploying a NAT instance which requires this setting to be disabled.

How to fix?

Set the instance source_dest_check attribute to true.

Example Configuration

resource "aws_instance" "allowed" {
  ami               = "ami-005e54dee72ccabcd"
  instance_type     = "t2.micro"
  source_dest_check = true
}