Check ID: vpc_endpoint_connections_trust_boundaries
Provider: AWS
Service: vpc
Severity: HIGH
Categories: trust-boundaries, identity-access
Resource type: AwsEc2VpcEndpointService
What this check verifies
VPC endpoint policies are assessed for restriction to configured trusted AWS accounts. If Principal values (including *) or account ARNs permit non-trusted principals, or conditions aren’t sufficiently restrictive, the endpoint is identified. Endpoints without editable policies are excluded.
Risk
Non-trusted principals using your endpoint can access AWS services as if from your VPC, weakening segmentation. This enables unauthorized reads/writes and data exfiltration from resources tied to the endpoint, harming confidentiality and integrity, and potentially increasing costs.
Recommendation
Apply least privilege: restrict endpoint policies to your account and an explicit allowlist of trusted accounts. Avoid * principals unless coupled with strict conditions. Prevent transitive trust across network links, and use resource policies and monitoring as defense in depth to limit endpoint use.
CLI
Terraform
Native IaC
Dashboard steps
aws ec2 modify-vpc-endpoint --vpc-endpoint-id <example_resource_id> --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"*","Resource":"*","Condition":{"StringEquals":{"aws:PrincipalAccount":["<TRUSTED_ACCOUNT_ID_1>","<TRUSTED_ACCOUNT_ID_2>"]}}}]}'
# Add this to the existing VPC endpoint resource to restrict access
resource "aws_vpc_endpoint" "<example_resource_name>" {
# ...existing required arguments for the endpoint...
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = "*"
Action = "*"
Resource = "*"
Condition = { # CRITICAL: restrict by trusted accounts
StringEquals = {
"aws:PrincipalAccount" = [ # CRITICAL: only these accounts can use the endpoint
"<TRUSTED_ACCOUNT_ID_1>",
"<TRUSTED_ACCOUNT_ID_2>"
]
}
}
}]
})
}
# CloudFormation: restrict VPC endpoint access to trusted accounts only
Resources:
<example_resource_name>:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: <example_resource_id>
ServiceName: com.amazonaws.<region>.<service>
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: "*"
Action: "*"
Resource: "*"
Condition: # CRITICAL: restrict by trusted accounts
StringEquals: # CRITICAL: only allow specified accounts
"aws:PrincipalAccount": # CRITICAL: limits usage to these accounts
- "<TRUSTED_ACCOUNT_ID_1>"
- "<TRUSTED_ACCOUNT_ID_2>"
- Open the AWS Console and go to VPC > Endpoints
- Select the endpoint and choose Actions > Manage policy
- Select Custom and paste this minimal policy, replacing with your trusted account IDs:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "*",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:PrincipalAccount": [
"<TRUSTED_ACCOUNT_ID_1>",
"<TRUSTED_ACCOUNT_ID_2>"
]
}
}
}
]
}
- Click Save
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_endpoint_connections_trust_boundaries. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks
