Creating a Policy when a new EIP is attached in AWS

Justin_Payne — Wed, 02 Sep 2020 17:59:54 GMT

Hi,
I have had times when end users assign an EIP to a EC2 instance causing some exposure. Is there a way I can create a policy to alert me when a new EIP is associated or requested?

Re: Creating a Policy when a new EIP is attached in AWS

FranciscoBreijo — Mon, 23 Mar 2020 13:34:58 GMT

You can leverage our Audit Policies with something along the below lines, in terms of RQL.

event where operation IN ( 'AssociateElasticIp', 'RegisterElasticIp', 'UpdateElasticIp' )

This will create an alert anytime you have a user actually make a change to the EIP.

Another way you can achieve this is by simply checking for instances that have a public IP. Though this will return existing systems that should or are known to have public IPs.

config where api.name = 'aws-ec2-describe-instances' AND json.rule = publicIpAddress exists and publicIpAddress is not empty

topic Creating a Policy when a new EIP is attached in AWS in Prisma Cloud Discussions

Creating a Policy when a new EIP is attached in AWS

Re: Creating a Policy when a new EIP is attached in AWS