An ECS instance is considered compliant if it is not directly attached to an IPv4 public IP address or an Elastic IP Address.
Scenarios
If your ECS instance needs to provide services to the Internet or access the Internet, use an ECS instance in a virtual private cloud (VPC). You can manage Internet traffic using SLB and NAT Gateway.
Risk level
Default risk level: Medium.
You can change the risk level of this rule as needed.
Detection logic
An ECS instance is considered compliant if it is not directly attached to an IPv4 public IP address or an Elastic IP Address.
An ECS instance is considered non-compliant if it is attached to an IPv4 public IP address or an Elastic IP Address. For more information, see Corrective actions.
Rule details
Parameter | Description |
Rule name | ECS instance is not attached to an IPv4 public IP address |
Rule identifier | ecs-instance-no-public-ip |
Tag | ECS, Instance |
Auto-remediation | Not supported |
Rule trigger mechanism | Configuration change |
Supported resource types | ECS instance |
Rule input parameters | None |
Corrective actions
You can create a new ECS instance that does not require a public IP address. For more information, see Create an instance on the Custom Launch tab.