Amazon VPCs are assessed for network segmentation: at least one public subnet (internet-routable) and one private subnet (non-internet-routable).
It flags VPCs with no subnets, only public subnets, or only private subnets.
Risk
Missing subnet separation erodes segmentation.
- Only public: workloads face Internet exposure, enabling scanning, brute force, and lateral movement, threatening confidentiality and integrity.
- Only private: no controlled egress can break patching and dependencies, impacting availability.
- No subnets: misconfiguration leaves services unreachable.
Run this check with Prowler CLI
prowler aws --checks vpc_subnet_separate_private_public
Recommendation
Segment each VPC: put internet-facing endpoints in public subnets and internal workloads in private subnets. Restrict ingress/egress with tight route tables, NACLs, and security groups, minimizing 0.0.0.0/0. Apply least privilege and defense in depth. Provide controlled outbound for private subnets via managed egress and use hardened admin access patterns.
Remediation
Native IaC
Terraform
Other
- In the AWS console, go to VPC > Your VPCs and select the failing VPC
- Attach an Internet Gateway if none exists: Internet Gateways > Create > Attach to the VPC
- Create two subnets: Subnets > Create subnet
- Subnet A (public): CIDR e.g., 10.0.1.0/24
- Subnet B (private): CIDR e.g., 10.0.2.0/24
- Create a route table for public subnet: Route tables > Create
- Add route: 0.0.0.0/0 -> Internet Gateway (IGW)
- Associate this route table to Subnet A (public)
- Create a route table for private subnet: Route tables > Create
- Do not add a route to an Internet Gateway
- Associate this route table to Subnet B (private)
- Verify the VPC now has at least one subnet with an IGW route (public) and one without (private)
Source Code
Resource Type
AwsEc2Subnet