The service can be configured with a NAT gateway that allows resources in private subnets to initiate connections to the internet without exposing them to inbound internet traffic.
Connectivity Options - NAT Gateways
CCC.VPC.CP09
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.VPC.TH08 | Unrestricted Outbound Traffic Enables Data Exfiltration | Internet and NAT gateways may be deployed without egress filtering, so that any resource in the network can initiate connections to any destination on the public internet. A compromised resource can then transfer data to external systems or reach command-and-control infrastructure, impacting the confidentiality of data. |
| CCC.VPC.TH14 | Network Resources are Confined to a Single Availability Zone | Subnets, NAT gateways, and VPN or private connection endpoints may be deployed in a single availability zone rather than placed across zones. A failure of that zone removes connectivity for every resource that depends on them, impacting the availability of workloads in the network. |