2

I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public.

I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed in tutorials etc, but I have a hard time believing it entails any security risk publishing these ids? (They are not ARN's, only ids, in the form vpc-abcde1.)

But better safe than sorry. Would anybody be able to nefariously peruse these ids?

  {
    "ParameterKey": "VpcId",
    "ParameterValue": "vpc-SCRUBBED"
  },
  {
    "ParameterKey": "SubnetId",
    "ParameterValue": "subnet-SCRUBBED"
  }

Bonus question: What about publishing my VPN public IP?

Improve this question
3
  • 2
    anyone who can observe your traffic will know your vpn end-point, but why broadcast it to more unknown adversaries via source-code control? does including this information in the code add any benefit to the user of the source-code? it seems to me that anyone with the id may be able to interrogate the vpn information using describe-vpcs, which appears to contain all the information about your subnet
    – brynk
    Mar 1, 2021 at 1:03
  • Thanks for your comment. You would need ec2:DescribeVPCs permissions on the AWS Account in order to describe-vpcs, so that's not really a concern for my organization. It could be in larger orgs, I suppose. Your point about "does it add benefit to publish" is a good perspective, which I will keep in mind. I suppose best practice would be to publish an empty parameters.json file, with keys only. Thanks again!
    – knutole
    Mar 1, 2021 at 10:56
  • 1
    ... and thank you for clarifying the permissions required to iterate the vpc properties
    – brynk
    Mar 1, 2021 at 12:30

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .