AppStream fleet has default internet access disabled

Check ID: appstream_fleet_default_internet_access_disabled
Provider: AWS
Service: appstream
Severity: MEDIUM
Categories: internet-exposed
Resource type: Other

What this check verifies

Amazon AppStream fleets are assessed for the EnableDefaultInternetAccess setting, identifying fleets where streaming instances have default Internet connectivity.

Risk

Direct Internet access gives streaming instances public exposure. Threats include:

Remote exploitation and malware, undermining confidentiality and integrity
Uncontrolled egress enabling data exfiltration

It also enforces ~100-instance limits, reducing availability for high-concurrency deployments.

Recommendation

Disable default Internet access (EnableDefaultInternetAccess=false) and place fleets in private subnets. Provide egress via NAT gateways or proxies, enforce egress filtering, and apply least privilege and zero trust to restrict outbound traffic. Use private connectivity to AWS services where possible.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws appstream update-fleet —name <example_resource_name> —no-enable-default-internet-access

# Terraform: disable default internet access on an AppStream fleet
resource "aws_appstream_fleet" "<example_resource_name>" {
  name          = "<example_resource_name>"
  instance_type = "stream.standard.small"
  image_name    = "<IMAGE_NAME>"
  compute_capacity { desired_instances = 1 }

  enable_default_internet_access = false  # Critical: disables default internet access to pass the check
}

# CloudFormation: disable default internet access on an AppStream fleet
Resources:
  <example_resource_name>:
    Type: AWS::AppStream::Fleet
    Properties:
      Name: <example_resource_name>
      InstanceType: <INSTANCE_TYPE>
      EnableDefaultInternetAccess: false  # Critical: disables default internet access to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = appstream_fleet_default_internet_access_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway V2 API has an authorizer configured AppStream fleet session duration is under 10 hours

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires