# Cross-Region Scanning on with private network

## OVERVIEW

For configuring cross-region access for AWS services without leaving the AWS Backbone first of all we need to follow the steps of leveraging endpoints for the console region mentioned in [our documentation](https://help.cloudstoragesec.com/how-it-works/deployment-details#leveraging-vpc-endpoints). Then we need to execute the same script in the desired region to interact with, allow communication through VPC endpoints and setup DNS resolution so the public url service endpoints get resolved to local ips instead of the public ones.

* Console Region: us-west-2
* Agent Region: us-east-2

## PROCEDURE

AWS lines up what is needed in order to accomplish this task in the following two documents:

* <https://repost.aws/knowledge-center/vpc-endpoints-cross-region-aws-services>: despite it says one or the other both sections are needed.
* <https://repost.aws/knowledge-center/vpc-peering-troubleshoot-dns-resolution>

### <mark style="color:green;">VPC Endpoint Cross-region access</mark>

Above tutorials contain a lot of suppositions and don’t have the level of detail necessary to actually understand the needed changes. The following are some steps done in our development accounts in order to accomplish cross region:

1. Apply CSS[ the CSS provided scripts](https://help.cloudstoragesec.com/how-it-works/deployment-details#leveraging-vpc-endpoints) about  leveraging VPC endpoints in the console’s and destination region.
2. Configure VPC Peering Connections between the console and destination region VPCs. Ensure DNS settings are enabled for both:

<figure><img src="https://lh7-us.googleusercontent.com/KXCPrGuhtkVH7NDxqxjo4RHZbq-DHlrIGlN8ZYUJ3jDhCAhyt9xOjFiyP7h5eNj9C9mhCxzSROD_569kwMkuERanM6cG31XTJXfBKOPtlqUgeH2t2eLsgvgm1aOjY2vVupjeQoDb1FA1kfwYTLwrXVs" alt=""><figcaption></figcaption></figure>

3. Configure route tables for both VPCs, in each of them add an entry containing the CIDR of the other region’s VPC and as destination the Peering connection:

<figure><img src="https://lh7-us.googleusercontent.com/dkA89KRVwwg-sFIP0RsD3Vw1cyzzbbAvyczM3jZ2DRUFzlFkZ4e7b-zlwH1R8HQdXqzOseDjacyIHDuWBhtu3m7jorCh5CzHMNGm95SnnJ8033QWajEOD2LGHjAwuauwzo8psZ8Cegswx2yw_s72770" alt=""><figcaption></figcaption></figure>

4. Validate no subnet contains access to a nat or internet gateway, meaning they can’t reach the internet. Create an Ubuntu instance that is in the Console’s region and subnet. Connect to it, probably using a bastion host (public instance within the same VPC but different subnet that can reach the private subnet).

<figure><img src="https://lh7-us.googleusercontent.com/o586dqc6SVq7UBgmeDhWsDYus-_wcszuU7Qt65ZwmeDdyKY7dX8PD7jLasrGYKSFiN3xGEgu-Jn1ephPVChSiETNMApdpSSguK-vBv0-OxpdRJootx1a1H07s_9D4zEdAk65CeAis2wJ1os2vl-D80g" alt=""><figcaption></figcaption></figure>

So right now you are in the console’s subnet, validate you are able to reach the EC2 service belonging to the other destination region (in this case us-east-2) by running the following command with valid AWS Credentials:

{% code overflow="wrap" %}

```
ubuntu@ip-10-0-143-117:~$ aws ec2 describe-volumes --max-items 1 --region us-east-2 --endpoint-url "http://172.31.47.168"
```

{% endcode %}

<figure><img src="https://lh7-us.googleusercontent.com/-nXW2ipHYkfkgbbzbDMH24T_lF4kMR-5-ZqHwuFVISdyAcC_nIYDZFS_IzhLmeD1c_qCKaNKLiYkLHgkW4GsATT7bj8Qxe8RyILKG2LrcR05hpkjM9STS5PKCGt_rwtX2TERxHW30gQtFiCemTtsq0U" alt=""><figcaption></figcaption></figure>

Keep in mind the usage of the destination region and the local private IP of the EC2 VPC Endpoint of the us-east-2 region. This is necessary since there is no DNS resolution configured for the endpoint “ec2.us-east-2.amazonaws.com”.

<figure><img src="https://lh7-us.googleusercontent.com/Kc0gKMOtuhBIe6ttansM0domEe_91iLPX0D5AxDVcQvqLFMQQIoOiZSNo1NyyoSDUelU8f_g6fHH3bC8i9kdtLBrDxc4roJJzXTa5vS65k-YZ698VCIRbjQKl9F-sxvI2X775eyfkCwPLVMIGYyKyI8" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Note also that without the endpoint specification the EC2 instance doesn’t know how to solve the service URL:
{% endhint %}

<figure><img src="https://lh7-us.googleusercontent.com/n6AzOhu59MZsx2SmpWSDnipX0gsvq06ufZoo8Ce06Uy2KyTZQgMczyQTGpqkLPVD64x45w7AnCRtUYhuq3-ppYgdy7iQ88a5EecIx-3MkeQn855UCg0_sc5RNE__Gmr6bT6tn6kfmun8cp9D2iJc3fs" alt=""><figcaption></figcaption></figure>

### <mark style="color:green;">Service Name DNS Resolution</mark>

At this point we are able to reach the VPC Endpoint located in the destination region but without being able to automatically solve the EC2 service. Let’s get into it.

1. Go to route 53 and add a new private hosted zone adding the console’s VPCs.

<figure><img src="https://lh7-us.googleusercontent.com/nl8G5lY4xIv8IdIlt-HGGTrxwtTDVb4kKBTFr4tEf7Ni3GAK6hOHe9_abxezjZ2pRBw2-zFR9RpPuDmpkfmvzQYpStM1TCTm_VHjM-qBMr66p5ipbPpJkC7zu5T1gjR3x756IJWuOvYgqZzeNWWoIVg" alt=""><figcaption></figcaption></figure>

2. Add an A record with Alias selected and the destination region VPC Endpoint as the target:

![](https://lh7-us.googleusercontent.com/DSJLnGxi6F-b0fsXuY6APTe5EPg4ho0LNAPrDBUeSxna-A-lAroWNdzTt4CYqCGq9XLkRmBK43A7vQ6_wZsQo6sj1sihszXjYCQKS5R1pptxTf7Dghq3_5Rhr82U5beLZqoL3YNp6aP7UtnoD-V0L5E)

3. Validate configuration by doing the Ec2 API call without endpoint specification:<br>

   <figure><img src="https://lh7-us.googleusercontent.com/u7U59ptt7FVciAizuBKJyVqihMLHrnIG_oF5-WWQLYGNzgVeHvL8g5Y82u_6phj-4_KXn61mKpGWYuQxno8LJ0g0hDS50Hd0hcjd9QFAUbHpvaOs2VnCCsfX5wmWHmBMSNNp3OFeoXpM9EejFJ6pCnk" alt=""><figcaption></figcaption></figure>

## Services Needed

Services that require this extra configuration since they are instantiated by the console in other regions:

* EC2: For Networking stuff
* ElasticFileSystem: To mount volumes
* CloudWatchLogs: To build statistic results, protecting a bucket (creates CloudStorageSecurity.ECS.{EnvironmentVariables.AppConfigAgentApplicationId}.{serviceDescription} and handles retention policy)
* CloudWatch (called monitoring): To create alarms.
* S3 (interface + gateway): To gather bucket properties. Remember to add a wildcard for the global bucket access:

```
{bucket-name}.s3.{region}.amazonaws.com
```

* SNS: To list topics
* ECS: For ECS related tasks, like creating a cluster or a service
* AppAutoScaling: for autoscaling policies triggered from CW Alarms

**VPC Endpoints in the Agent Region**

<figure><img src="https://lh7-us.googleusercontent.com/8pruHgykt64G9T38AhSZ0hfuLKs79mMLTd9U7SUBxGLlvT2HZZUOGqefVq_z1KGJTZh6_YBQZB4TOhKcymNvemjsBlvh4lA0hmCKY3UFl6Prr3RsKvYqtaBEuiIF_qAUnpG22SA6QzeTvoagwTnWWjg" alt=""><figcaption></figcaption></figure>

**VPC Endpoints in the Console Region**

<figure><img src="https://lh7-us.googleusercontent.com/ITo7ORnqtb78vWzMgEhoGgNpPLU4G3c1kDccEms1nDXeTkYUNEc6piLgOvtAen_vB1V-CNBzfSUtQVmBgoiUFcTKUpATuCqTQk7bt3seTzn7jI4Rq1bKnWu9NLTZqWvNK3hZYJT-GH99qJZhAcONY-c" alt=""><figcaption></figcaption></figure>

**Route53 custom endpoints configuration**

<figure><img src="https://lh7-us.googleusercontent.com/TSD6uvMvYHFMMcwF0zgA87d9xKjm189uP8BxbYI96-kpkwyGP3c4t2jFfohLR0f1uxHw8soCN8pYz5i0dnIJRDjxtdwK4BVGldgdQKuM8AR4YsctmxCrnZDANyCG0BErPellMCY1uzmCD9XnXsgHVgM" alt=""><figcaption></figcaption></figure>

## REMARKS

* The agent task running in the external region needs a proxy defined to reach DynamoDB or internet access to allow its resolution.
* SNS notifications for the Agent will fail since it doesn’t know how to resolve the Console’s region SNS URL endpoint. A route53 entry resolution is needed for the console region associated with the agent region VPC and pointing to resolution for the VPC SNS Endpoint of the console. Also remember to add a rule to the Security Grouping allowing the VPC CIDR of the agent.

## CONCLUSIONS

Using a private subnet allowing only a few services (Marketplace, AppConfig and Cognito) to go through the public internet (maybe behind a proxy) and then all the other services being accessed through VPC Endpoints is definitely doable, even for all the regions.

Pros:

* Great reduction in the amount of traffic over the public internet.

Cons:

* Increased infrastructure costs.
* Increased infrastructure complexity, harder to configure and to maintain.
* New AWS services usage from our part can break console functionality.
* Costs: only the VPC piece cost around $10 daily for the Console region and $7 daily for each extra region.