All checks
Medium
EC2 network interfaces should have source/destination checking enabled
Verifies that source/destination checking is enabled on user-managed EC2 network interfaces, so each handles only traffic it sends or receives itself. With it off, the interface can spoof source addresses or relay traffic between networks; a NAT instance that needs it off can be replaced by a NAT gateway.
- service
- EC2
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Network Interfaces → the interface → Actions → Change source/dest check
With the AWS CLI
aws ec2 modify-network-interface-attribute --network-interface-id <network-interface-id> --source-dest-check Value=true --region <region>With Terraform
resource "aws_network_interface" "this" {
subnet_id = var.subnet_id
source_dest_check = true
}See which of your accounts this check is failing on.
Book a demo