VPC subnet does not assign public IP addresses by default
vpc_subnet_no_public_ip_by_default
VPC subnets where MapPublicIpOnLaunch is true automatically assign a public IPv4 address to instances at launch.
This identifies subnets configured for default public IP assignment.
Risk
Internet-exposed instances become reachable by default, enabling port scans, SSH/RDP brute force, and exploit attempts. Successful access can lead to data exfiltration (confidentiality), unauthorized changes (integrity), and outages (availability) through abuse or DDoS.
prowler aws --checks vpc_subnet_no_public_ip_by_default
Recommendation
Disable subnet auto-assign to enforce least-privilege exposure. Place workloads in private subnets, use controlled egress (NAT or private endpoints), and prefer bastions or SSM for administration.
When public access is necessary, assign IPs explicitly and restrict with tight security groups and routes for defense in depth.
Remediation
aws ec2 modify-subnet-attribute --subnet-id <SUBNET_ID> --no-map-public-ip-on-launch
- Open the AWS Console and go to VPC
- Click Subnets and select the target subnet
- Choose Actions > Edit subnet settings (or Modify auto-assign IP settings)
- Uncheck Enable auto-assign public IPv4 address
- Save changes
Source Code
Resource Type
AwsEc2Subnet