Back to Checks
aws

VPCs are present in more than one region

vpc_different_regions
Service: vpcSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsEc2Vpc

Non-default VPCs are evaluated across the account to determine whether they exist in more than one region. The result reflects if your custom network topology is regionally distributed or concentrated in a single region.

Prowler logoProwlerprowler-provider-aws

Risk

Single-region VPC deployment weakens availability and resilience. A regional outage, service disruption, or network control misconfiguration can cause broad downtime, hinder recovery, and increase the blast radius of incidents impacting business continuity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks vpc_different_regions

Recommendation

Adopt a multi-region network design:

  • Create VPCs in at least two regions for critical workloads
  • Replicate routing, security controls, and endpoints consistently
  • Apply fault tolerance and defense in depth with data replication and resilient DNS/failover to avoid single-region dependency

Remediation

CLI

aws ec2 create-vpc --region <OTHER_REGION> --cidr-block <CIDR_BLOCK>

Terraform

provider "aws" {
  alias  = "other"
  region = "<OTHER_REGION>" # Critical: ensures the VPC is created in a second region
}

resource "aws_vpc" "<example_resource_name>" {
  provider   = aws.other
  cidr_block = "10.0.0.0/16" # Critical: creates a non-default VPC in that region
}

NativeIaC

# Deploy this stack in a second AWS region to pass the check
Resources:
  <example_resource_name>:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16  # Critical: creates a non-default VPC in this region

Other

1Open the AWS Console and go to VPC
2In the Region selector (top right), choose a different region than your existing non-default VPCs
3Click Create VPC > VPC only
4Enter an IPv4 CIDR block (e.g., 10.0.0.0/16)
5Click Create VPC
6Verify a non-default VPC now exists in this second region

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class vpc_different_regions(Check):
    def execute(self):
        findings = []
        if len(vpc_client.vpcs) > 0:
            vpc_regions = set()
            for vpc in vpc_client.vpcs.values():
                if not vpc.default:
                    vpc_regions.add(vpc.region)

            report = Check_Report_AWS(
                metadata=self.metadata(), resource=vpc_client.vpcs
            )
            report.region = vpc_client.region
            report.resource_id = vpc_client.audited_account
            report.resource_arn = vpc_client.vpc_arn_template

            report.status = "FAIL"
            report.status_extended = "VPCs found only in one region."

            if len(vpc_regions) > 1:
                report.status = "PASS"
                report.status_extended = "VPCs found in more than one region."
            findings.append(report)

        return findings

References