Networking / VPC / Controls / DEV
Deploy Network Resources Across Availability Zones
CCC.VPC.CN13 · Networking
Ensure that the loss of a single availability zone does not remove connectivity for workloads in the virtual network.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP09 | Connectivity Options - NAT Gateways | The service can be configured with a NAT gateway that allows resources in private subnets to initiate connections to the internet without exposing them to inbound internet traffic. |
| CCC.VPC.CP13 | Connectivity Options - Site-to-site VPN | The service can establish an encrypted site-to-site VPN connection over the public internet between the virtual network and an on-premises network. |
| CCC.VPC.CP06 | Multiple Availability Zone Placement | The service can place subnets, gateways, and connection endpoints in more than one availability zone so that the loss of a single zone does not remove connectivity for the virtual network. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH14 | Network Resources are Confined to a Single Availability Zone | Subnets, NAT gateways, and VPN or private connection endpoints may be deployed in a single availability zone rather than placed across zones. A failure of that zone removes connectivity for every resource that depends on them, impacting the availability of workloads in the network. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN13.AR01 | When workloads in more than one availability zone depend on a NAT gateway, the service MUST provide a NAT gateway in every availability zone those workloads occupy. | tlp-green, tlp-amber, tlp-red |
| CCC.VPC.CN13.AR02 | When a site-to-site VPN or private connection is established in a region with multiple availability zones, the service MUST terminate it in at least two availability zones. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | CP-8 | |