VPC subnet automatically assigns public IPs on launch

What it checks

VPC subnet automatically assigns public IPs on launch

Where it applies

Terraform: aws_subnet

CloudFormation: AWS::EC2::Subnet

How to fix it

1. Set map_public_ip_on_launch = false. Instances that genuinely need a public IP should use an Elastic IP (aws_eip) or a NAT gateway for outbound access.

Frameworks

• AWS FSBP EC2.15
• SOC 2 CC6.6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules