VPCs are present in more than one region

Check ID: vpc_different_regions
Provider: AWS
Service: vpc
Severity: MEDIUM
Categories: resilience
Resource type: AwsEc2Vpc

What this check verifies

Non-default VPCs are evaluated across the account to determine whether they exist in more than one region. The result reflects if your custom network topology is regionally distributed or concentrated in a single region.

Risk

Single-region VPC deployment weakens availability and resilience. A regional outage, service disruption, or network control misconfiguration can cause broad downtime, hinder recovery, and increase the blast radius of incidents impacting business continuity.

Recommendation

Adopt a multi-region network design:

Create VPCs in at least two regions for critical workloads
Replicate routing, security controls, and endpoints consistently
Apply fault tolerance and defense in depth with data replication and resilient DNS/failover to avoid single-region dependency

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 create-vpc —region <OTHER_REGION> —cidr-block <CIDR_BLOCK>

provider "aws" {
  alias  = "other"
  region = "<OTHER_REGION>" # Critical: ensures the VPC is created in a second region
}

resource "aws_vpc" "<example_resource_name>" {
  provider   = aws.other
  cidr_block = "10.0.0.0/16" # Critical: creates a non-default VPC in that region
}

# Deploy this stack in a second AWS region to pass the check
Resources:
  <example_resource_name>:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16  # Critical: creates a non-default VPC in this region

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_different_regions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS account is subscribed to an AWS Premium Support plan VPC endpoint policy allows only trusted AWS accounts

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires