VPC subnet does not assign public IP addresses by default

Check ID: vpc_subnet_no_public_ip_by_default
Provider: AWS
Service: vpc
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2Subnet

What this check verifies

VPC subnets where MapPublicIpOnLaunch is true automatically assign a public IPv4 address to instances at launch. This identifies subnets configured for default public IP assignment.

Risk

Internet-exposed instances become reachable by default, enabling port scans, SSH/RDP brute force, and exploit attempts. Successful access can lead to data exfiltration (confidentiality), unauthorized changes (integrity), and outages (availability) through abuse or DDoS.

Recommendation

Disable subnet auto-assign to enforce least-privilege exposure. Place workloads in private subnets, use controlled egress (NAT or private endpoints), and prefer bastions or SSM for administration. When public access is necessary, assign IPs explicitly and restrict with tight security groups and routes for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 modify-subnet-attribute —subnet-id <SUBNET_ID> —no-map-public-ip-on-launch

# Subnet with public IP auto-assign disabled
resource "aws_subnet" "example" {
  vpc_id     = "<example_resource_id>"
  cidr_block = "10.0.1.0/24"

  map_public_ip_on_launch = false  # Critical: prevents assigning public IPs by default
}

# CloudFormation: Subnet with public IP auto-assign disabled
Resources:
  ExampleSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: <example_resource_id>
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: false  # Critical: disables automatic public IPv4 assignment on instance launch

References

https://docs.aws.amazon.com/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_subnet_no_public_ip_by_default. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

VPC has subnets in more than one Availability Zone VPC has both public and private subnets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires