Amazon EC2
      Back to home
      1. CNS Policies
      2. AWS Knowledge Base
      3. Amazon EC2

      VPC Elastic IP Limit Breach

      This plugin determines if the number of allocated VPC EIPs is close to the AWS per-account limit

      Risk Level: Low

      Description

      This plugin determines if the number of allocated VPC EIPs is close to the AWS per-account limit. AWS limits account to certain numbers of VPC Elastic IPs. Exceeding those limits could prevent resources from launching.

      Configuration Parameters


      Instance Limit Threshold: This parameter specifies the percentage limit of the number of VPC EIPs. An issue is created when the number of VPC EIPs exceeds the provided threshold limit.

      By default, the value is 90, therefore it will return a vulnerability alert when the number of VPC EIPs will exceed 90% of the limit. 

      About the Service

      Amazon EC2: Amazon Elastic Compute Cloud (Amazon EC2) provides scalable computing capacity in the Amazon Web Services (AWS) Cloud. With the EC2 instance, you can launch as many virtual servers as you need, configure security and networking, and manage storage without worrying about the hardware needs of the process. Security Groups act as a firewall for an EC2 instance to control the incoming and outgoing traffic. You can read more about security groups here.

      Impact

      In case, the number of IPs exceeds the current limit, new elastic IPs could not be allocated. This can be a blocker for scaling up your infrastructure. Therefore, it is recommended to initiate a request to increase the VPC Elastic IP limit for the EC2 instances.

      Steps to Reproduce

      Using AWS Console-

      1. Log In to your AWS Console.
      2. Open the EC2 Management Console. You can use this link (https://console.aws.amazon.com/ec2) to navigate directly if already logged in. 
      3. Move to the Limits section from the left navigation pane.
      4. Search for EC2-VPC Elastic IPs and find the Current Limit for it.
      5. Now move to Elastic IPs from the Network and security section from the left navigation pane.
      6. You can find a number of elastic IPs. Verify if it has a VPC scope by first selecting the IP address by clicking on the checkbox next to it and then checking if its scope is VPC.
      7. If the number of IPs exceed the percentage, the vulnerability exists. 
      8. Repeat steps for all the regions you want to investigate.

      Steps for Remediation

      Contact AWS support to increase the number of VPC IPs available.

      1. Log In to your AWS Console.
      2. Open the EC2 Management Console. You can use this link (https://console.aws.amazon.com/ec2) to navigate directly if already logged in. 
      3. Move to the Limits section from the left navigation pane.
      4. Search for EC2-VPC Elastic IPs and click on the radio button next to it to select it.
      5. Click on Request Limit increase from the top right corner. It will redirect you to the AWS Support page.
      6. Mention the Region and the use case for which you want to increase the limit and send the request. You will be contacted by the support team for further action.
      7. Repeat steps for other regions as well.