| CCC.VPC.TH01 | Access is Granted Through Insecure Default Network Settings | Default network configurations may include insecure settings and open firewall rules, leading to unauthorized access and potential data breaches. | 0 | 1 | 1 |
| CCC.VPC.TH02 | Resources are Exposed to the Public Internet | Assignment of external IP addresses to resources, including globally routable IPv6 addresses, exposes resources to the public internet, increasing the risk of attacks such as brute force, exploitation of vulnerabilities, or unauthorized access. | 0 | 1 | 1 |
| CCC.VPC.TH03 | Network Access is Granted Through Unauthorized Peering or Transit Attachments | Unauthorized peering connections or transit hub attachments can allow network traffic between untrusted or unapproved subscriptions, leading to potential data exposure or exfiltration. | 0 | 1 | 1 |
| CCC.VPC.TH04 | Network Traffic is Not Recorded When Flow Logs are Disabled | VPC subnets with disabled flow logs lack critical network traffic visibility, which can lead to undetected unauthorized access, data exfiltration, and network misconfigurations. This lack of visibility increases the risk of undetected security incidents. | 0 | 1 | 1 |
| CCC.VPC.TH05 | Private Endpoint Policies Permit Access by Unintended Principals | Private endpoint policies that are overly permissive may inadvertently expose resources within the VPC to unintended principals or external threats. | 0 | 1 | 1 |
| CCC.VPC.TH06 | Overlapping Address Ranges Disrupt Connectivity | Address ranges may be assigned that overlap with those of peered networks or transit hub spokes. Traffic destined for the overlapping range is dropped or routed to the wrong network and the connection cannot be established, impacting the availability of connected resources and the integrity of traffic that reaches an unintended destination. | 0 | 1 | 1 |
| CCC.VPC.TH07 | Routes are Modified to Redirect or Expose Traffic | Route tables may be modified to send traffic through an unauthorized network appliance, or to add an internet or NAT gateway route to a subnet that was designed to be private. Traffic is then observed or altered in transit, or resources gain an unintended path to the public internet, impacting the confidentiality and integrity of data and enabling exfiltration. | 0 | 1 | 1 |
| CCC.VPC.TH08 | Unrestricted Outbound Traffic Enables Data Exfiltration | Internet and NAT gateways may be deployed without egress filtering, so that any resource in the network can initiate connections to any destination on the public internet. A compromised resource can then transfer data to external systems or reach command-and-control infrastructure, impacting the confidentiality of data. | 0 | 2 | 1 |
| CCC.VPC.TH09 | Compromise Propagates Over Hybrid Connections | Private connections, site-to-site VPNs, and transit hubs may be configured with routes and network rules that permit broad access between on-premises networks and the virtual network. A compromise of either side can be used to move laterally into the other, impacting the confidentiality, integrity, and availability of resources on both sides of the connection. | 0 | 1 | 1 |
| CCC.VPC.TH10 | Hybrid Connection Traffic is Unencrypted or Weakly Encrypted | Dedicated private connections may carry traffic without encryption, and VPN tunnels may be negotiated with deprecated protocol versions or weak key-exchange groups. Traffic traversing the connection can be read or modified by an entity with access to the transmission path, impacting the confidentiality and integrity of data. | 0 | 1 | 1 |
| CCC.VPC.TH11 | DNS Resolution is Hijacked to Redirect Traffic | Private DNS zones, resolver forwarding rules, or the DNS servers handed out through DHCP may be created or modified so that names resolve to addresses controlled by an unauthorized entity. Resources connect to the wrong destination and credentials or data are exposed to that destination, impacting the confidentiality and integrity of data. | 0 | 1 | 1 |
| CCC.VPC.TH12 | DNS Queries are Used as a Covert Exfiltration Channel | The built-in resolver forwards queries for any external domain, so a compromised resource can encode data in DNS queries to a domain it controls even when other outbound traffic is blocked. Data leaves the network without traversing the filtered egress path, impacting the confidentiality of data. | 0 | 1 | 1 |
| CCC.VPC.TH13 | Mirrored Traffic is Delivered to Unauthorized Destinations | A traffic mirroring session may be created or its target modified so that full packet copies of network traffic are delivered to a resource that is not an authorized monitoring destination. Plaintext payloads and credentials within the mirrored traffic are exposed, impacting the confidentiality of data. | 0 | 1 | 1 |
| CCC.VPC.TH14 | Network Resources are Confined to a Single Availability Zone | Subnets, NAT gateways, and VPN or private connection endpoints may be deployed in a single availability zone rather than placed across zones. A failure of that zone removes connectivity for every resource that depends on them, impacting the availability of workloads in the network. | 0 | 1 | 1 |