Back to Checks
aws

AppStream fleet has default internet access disabled

appstream_fleet_default_internet_access_disabled
Service: appstreamSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

Amazon AppStream fleets are assessed for the EnableDefaultInternetAccess setting, identifying fleets where streaming instances have default Internet connectivity.

Prowler logoProwlerprowler-provider-aws

Risk

Direct Internet access gives streaming instances public exposure. Threats include:

  • Remote exploitation and malware, undermining confidentiality and integrity
  • Uncontrolled egress enabling data exfiltration

It also enforces ~100-instance limits, reducing availability for high-concurrency deployments.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks appstream_fleet_default_internet_access_disabled

Recommendation

Disable default Internet access (EnableDefaultInternetAccess=false) and place fleets in private subnets. Provide egress via NAT gateways or proxies, enforce egress filtering, and apply least privilege and zero trust to restrict outbound traffic. Use private connectivity to AWS services where possible.

Remediation

CLI

aws appstream update-fleet --name <example_resource_name> --no-enable-default-internet-access

Terraform

# Terraform: disable default internet access on an AppStream fleet
resource "aws_appstream_fleet" "<example_resource_name>" {
  name          = "<example_resource_name>"
  instance_type = "stream.standard.small"
  image_name    = "<IMAGE_NAME>"
  compute_capacity { desired_instances = 1 }

  enable_default_internet_access = false  # Critical: disables default internet access to pass the check
}

NativeIaC

# CloudFormation: disable default internet access on an AppStream fleet
Resources:
  <example_resource_name>:
    Type: AWS::AppStream::Fleet
    Properties:
      Name: <example_resource_name>
      InstanceType: <INSTANCE_TYPE>
      EnableDefaultInternetAccess: false  # Critical: disables default internet access to pass the check

Other

1In the AWS console, go to Amazon AppStream 2.0 > Fleets
2Select the target fleet
3If the fleet is RUNNING, click Actions > Stop and wait until the state is Stopped
4Click Edit (or Modify)
5Uncheck "Default internet access" (Disable "Enable default internet access")
6Save/Update the fleet and start it if needed

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.appstream.appstream_client import appstream_client


# Check if there are AppStream Fleets with the default internet access enabled
class appstream_fleet_default_internet_access_disabled(Check):
    """Check if there are AppStream Fleets with the default internet access enabled"""

    def execute(self):
        """Execute the appstream_fleet_default_internet_access_disabled check"""
        findings = []
        for fleet in appstream_client.fleets:
            report = Check_Report_AWS(metadata=self.metadata(), resource=fleet)

            if fleet.enable_default_internet_access:
                report.status = "FAIL"
                report.status_extended = (
                    f"Fleet {fleet.name} has default internet access enabled."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Fleet {fleet.name} has default internet access disabled."
                )

            findings.append(report)

        return findings

References