Ensure routing tables for VPC peering are "least access"

4.4 Networking (AWS CIS Benchmark).


Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired. You can even peer a VPC to just a single host on the other side of the connection.

Remove and add route table entries to ensure that the least number of subnets or hosts is required to accomplish the purpose for peering are routable.

Give VPC peering routing tables "least access" via CLI

Step 1. For each <route_table_id> containing routes non compliant with your routing policy (which grants more than desired "least access"), delete the non compliant route: aws ec2 delete-route --route-table-id <route_table_id> --destination-cidrblock <non_compliant_destination_CIDR>

Step 2. Create a new compliant route: aws ec2 create-route --route-table-id <route_table_id> --destination-cidrblock <compliant_destination_CIDR> --vpc-peering-connection-id <peering_connection_id>