AWS VPC
This plugin collects read-only AWS VPC networking data from EC2 and CloudWatch Logs, evaluates CCF Rego policy bundles, and emits evidence back through the CCF agent.
This page is for operators who run the plugin-aws-vpc plugin with the CCF Agent, and for developers who write policies for it. It documents v0.3.1 and is generated from the plugin's README at v0.3.1.
How it works
How it fits in CCF
The CCF agent starts this binary through HashiCorp go-plugin, passes configuration and policy paths over gRPC, and receives generated evidence through the runner callback. This repository does not call the CCF API directly.
Configuration
The plugin expects:
- AWS credentials through the default AWS SDK credential chain
- target regions from
config.regionsorconfig.region AWS_REGIONas a fallback when plugin config does not provide a region
Any agent-supplied policy_data is passed through to Rego as data.*.
Evidence collected
Supported resource families
The collector can evaluate policies for:
- VPCs
- subnets
- security groups
- network ACLs
- route tables
Data collected
Depending on the selected policy bundles, the plugin can collect and correlate:
- VPCs and VPC attributes
- DHCP options
- subnets
- route tables
- internet gateways
- VPC endpoints
- security groups
- network ACLs
- flow logs
- related CloudWatch log groups
- transit gateway attachments
- network interfaces
Policies
The policy bundles that work with this plugin, at their newest releases. The controls are the ones the bundle's policies list in their metadata.
| Bundle | Latest version | Controls covered | Compatible plugin lines |
|---|---|---|---|
plugin-aws-vpc-nacl-policies | v0.1.0 | none listed | latest |
plugin-aws-vpc-policies | v0.1.0 | none listed | latest |
plugin-aws-vpc-rt-policies | v0.1.0 | none listed | latest |
plugin-aws-vpc-sg-policies | v0.3.0 | none listed | latest |
plugin-aws-vpc-subnet-policies | v0.1.0 | none listed | latest |
Default policy bundle mapping
| Repository | Behavior | Primary input |
|---|---|---|
plugin-aws-vpc-policies | vpc | input.vpc + input.vpc_context |
plugin-aws-vpc-subnet-policies | subnet | input.subnet + input.subnet_context |
plugin-aws-vpc-sg-policies | sg | input.security_group + input.sg_context |
plugin-aws-vpc-nacl-policies | acl | input.network_acl + input.nacl_context |
plugin-aws-vpc-rt-policies | rt | input.route_table + input.route_table_context |