EC2.172: VPC Block Public Access is not enabled

What does AWS Security Hub EC2.172 check?

EC2.172 fails an account where VPC Block Public Access (BPA) is off (mode off) in a region that holds workloads. BPA is a per-region, account-level switch above every VPC that blocks Internet Gateway traffic regardless of route tables, NACLs, or security groups; the control assumes a deny-by-default posture with explicit exclusions.

Why does EC2.172 matter?

BPA is the network-layer equivalent of S3 Block Public Access — one coarse switch that overrides every per-VPC misconfiguration at once. In a regulated environment where most VPCs should never touch the public internet, leaving it off means a single bad route table or over-broad security group can expose a workload, with nothing above the VPC catching it.

How do I fix EC2.172?

1. Inventory every IGW in the target region and trace which workloads depend on it using describe-internet-gateways and a week of flow logs.
2. Enable block-ingress first to stop inbound internet connections while preserving outbound, then move to block-bidirectional once verified.
3. Add per-VPC or per-subnet exclusions sparingly for the egress VPC and anything that legitimately needs an IGW, tagging each with an owner and justification.
4. Layer an SCP denying ec2:ModifyVpcBlockPublicAccessOptions and ec2:DeleteVpcBlockPublicAccessExclusion so the control cannot be silently disabled.

# Close the highest-impact public exposure first: databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --no-publicly-accessible --apply-immediately
  echo "$db: public access removed"
done

# Ratchet S3 shut at the account level so no bucket can be made public again.
aws s3control put-public-access-block --account-id 123456789012 \
  --public-access-block-configuration \
    'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'