# Every route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/boundary-access-points-and-default-deny Recipe id: `boundary-access-points-and-default-deny` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-MAT` - KSI `KSI-CNA-RNT` - control `sc-7.3` - control `sc-7.4` - control `sc-7.5` ## Collection Kind: `cli` ```sh # describe-internet-gateways aws ec2 describe-internet-gateways --query 'InternetGateways[].{Igw:InternetGatewayId,Attachments:Attachments[].{Vpc:VpcId,State:State}}' # describe-nat-gateways aws ec2 describe-nat-gateways --query 'NatGateways[].{Nat:NatGatewayId,State:State,Vpc:VpcId,Subnet:SubnetId,Connectivity:ConnectivityType}' # describe-vpc-endpoints aws ec2 describe-vpc-endpoints --query 'VpcEndpoints[].{Endpoint:VpcEndpointId,Type:VpcEndpointType,Service:ServiceName,Vpc:VpcId,State:State}' # describe-vpn-connections aws ec2 describe-vpn-connections --query 'VpnConnections[].{Vpn:VpnConnectionId,State:State,Category:Category,Tunnels:VgwTelemetry[].{Ip:OutsideIpAddress,Status:Status,Changed:LastStatusChange}}' # describe-network-acls aws ec2 describe-network-acls --query 'NetworkAcls[].{Acl:NetworkAclId,Default:IsDefault,Vpc:VpcId,Entries:Entries[].{Rule:RuleNumber,Action:RuleAction,Egress:Egress,Cidr:CidrBlock,Protocol:Protocol}}' # describe-firewall-policy aws network-firewall describe-firewall-policy --firewall-policy-name --query 'FirewallPolicy.{Stateless:StatelessDefaultActions,Fragments:StatelessFragmentDefaultActions,Stateful:StatefulDefaultActions}' # vpc-default-security-group-closed aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-default-security-group-closed --compliance-types NON_COMPLIANT # subnet-auto-assign-public-ip-disabled aws configservice get-compliance-details-by-config-rule --config-rule-name subnet-auto-assign-public-ip-disabled --compliance-types NON_COMPLIANT # netfw-policy-default-action-full-packets aws configservice get-compliance-details-by-config-rule --config-rule-name netfw-policy-default-action-full-packets --compliance-types NON_COMPLIANT ``` ## Expected output A short, closed list of access points you can put next to your documented boundary: one internet gateway per VPC that is meant to have one and none attached to a VPC that is not, NAT gateways whose ConnectivityType matches whether that subnet is supposed to reach the internet at all, VPC endpoints that keep service traffic off the internet, and VPN connections whose VgwTelemetry shows both tunnels UP with a LastStatusChange that is not flapping. On the deny side: network ACL Entries in which no allow rule opens a CIDR wider than your documented exceptions, an empty NON_COMPLIANT set from vpc-default-security-group-closed meaning every VPC's default security group carries no inbound or outbound rule at all, an empty set from subnet-auto-assign-public-ip-disabled meaning no subnet hands instances a public address on launch, and a firewall policy whose StatelessDefaultActions and StatelessFragmentDefaultActions are aws:drop (or aws:forward_to_sfe into a stateful engine whose StatefulDefaultActions is aws:drop_strict) rather than aws:pass. Managed rule identifiers: VPC_DEFAULT_SECURITY_GROUP_CLOSED, SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED, NETFW_POLICY_DEFAULT_ACTION_FULL_PACKETS, NETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETS ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud Amazon VPC, Amazon EC2, AWS Config and AWS Network Firewall are all available in AWS GovCloud (US) — the GovCloud user guide records no differences for Network Firewall — but the two Network Firewall managed rules (NETFW_POLICY_DEFAULT_ACTION_FULL_PACKETS and NETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETS) are explicitly unavailable in AWS GovCloud (US-East) and AWS GovCloud (US-West), so read the default actions straight from describe-firewall-policy there and drop the rule call; gateway, endpoint and firewall ARNs use partition arn:aws-us-gov ## Notes The inventory is telemetry; the limit is policy. SC-07.03 asks that external connections be held to the minimum needed and each one routed through a managed interface — these calls enumerate every gateway, endpoint and tunnel exactly, but whether that count is the minimum is a comparison against your documented architecture, and nothing in the API tells you a gateway is unnecessary. SC-07.04 is the weakest half here: describe-vpn-connections proves the tunnels exist and are up, but the control also wants each external telecommunications interface documented with its business need and traffic-flow policy, exceptions reviewed and removed — that record is a document, not a call. This recipe also does not cover carrier links terminated outside these APIs (AWS Direct Connect connections, Transit Gateway peering to another network); enumerate those separately if you use them. SC-07.05 is the closest to full: the default-deny posture of security groups, network ACLs and the firewall policy is directly readable, and vpc-default-security-group-closed is a clean pass/fail. Read the ACL Entries yourself rather than trusting a rule verdict — an allow entry with a low rule number can shadow everything below it, and no managed rule scores ordering. Substitute your real firewall policy name; describe-firewall-policy is one policy per call. Security-group ingress is covered by the SC-07 recipe (restricted-ssh, vpc-sg-open-only-to-authorized-ports) and not repeated here. ## References - {"title":"AWS CLI: ec2 describe-internet-gateways","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-internet-gateways.html"} - {"title":"AWS CLI: ec2 describe-nat-gateways (ConnectivityType)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"} - {"title":"AWS CLI: ec2 describe-vpc-endpoints","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html"} - {"title":"AWS CLI: ec2 describe-vpn-connections (VgwTelemetry tunnel status)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpn-connections.html"} - {"title":"AWS CLI: ec2 describe-network-acls (Entries, RuleAction)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-acls.html"} - {"title":"AWS CLI: network-firewall describe-firewall-policy (StatelessDefaultActions)","url":"https://docs.aws.amazon.com/cli/latest/reference/network-firewall/describe-firewall-policy.html"} - {"title":"AWS Config managed rule: vpc-default-security-group-closed","url":"https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html"} - {"title":"AWS Config managed rule: subnet-auto-assign-public-ip-disabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.html"} - {"title":"AWS Config managed rule: netfw-policy-default-action-full-packets (not available in GovCloud)","url":"https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-full-packets.html"} - {"title":"AWS Config managed rule: netfw-policy-default-action-fragment-packets (not available in GovCloud)","url":"https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-fragment-packets.html"} - {"title":"AWS Network Firewall in AWS GovCloud (US)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-nf.html"}