Creating a Policy when a new EIP is attached in AWS

[Justin_Payne]

Hi, 
I have had times when end users assign an EIP to a EC2 instance causing some exposure. Is there a way I can create a policy to alert me when a new EIP is associated or requested?

[FranciscoBreijo]

You can leverage our Audit Policies with something along the below lines, in terms of RQL.

event where operation IN ( 'AssociateElasticIp', 'RegisterElasticIp', 'UpdateElasticIp' )

This will create an alert anytime you have a user actually make a change to the EIP.

Another way you can achieve this is by simply checking for instances that have a public IP. Though this will return existing systems that should or are known to have public IPs.

config where api.name = 'aws-ec2-describe-instances' AND json.rule = publicIpAddress exists and publicIpAddress is not empty