Check ID: vpc_peering_routing_tables_with_least_privilege
Provider: AWS
Service: vpc
Severity: MEDIUM
Categories: trust-boundaries, internet-exposed
Resource type: AwsEc2VpcPeeringConnection

​
What this check verifies

AWS VPC peering route tables are assessed for least-privilege routing. Routes that target 0.0.0.0/0 or an entire peer VPC CIDR are considered overly broad; only specific subnets or narrower prefixes should be advertised across the peering link.

​
Risk

Broad peering routes expand cross-VPC reachability, enabling lateral movement and unauthorized discovery, harming confidentiality and integrity. Using 0.0.0.0/0 or full-CIDR paths also increases misrouting with overlapping ranges, reducing network availability.

​
Recommendation

Enforce least privilege in peering: advertise only required subnets or more specific prefixes; avoid 0.0.0.0/0 and whole VPC ranges. Keep routes symmetric on both sides, and layer defense in depth with security groups and NACLs. If broad connectivity is required, prefer segmented designs or a transit gateway.

​
Remediation

# Restrict VPC peering route to a specific subnet (least privilege)
resource "aws_route" "peering_specific" {
  route_table_id             = "<example_resource_id>"
  destination_cidr_block     = "10.0.1.0/24"  # CRITICAL: specific subnet, not 0.0.0.0/0 or full VPC CIDR
  vpc_peering_connection_id  = "<example_resource_id>"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_peering_routing_tables_with_least_privilege. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks