VPC has an Amazon EC2 VPC endpoint

Check ID: vpc_endpoint_for_ec2_enabled
Provider: AWS
Service: vpc
Severity: MEDIUM
Categories: internet-exposed, trust-boundaries
Resource type: AwsEc2VpcEndpointService

What this check verifies

Amazon VPCs are evaluated for an interface VPC endpoint to the Amazon EC2 API (ec2). Its presence indicates private EC2 API connectivity over AWS PrivateLink within the VPC.

Risk

Without a private EC2 endpoint, EC2 API traffic exits via IGW/NAT. This expands exposure to network path threats (e.g., DNS hijack, MITM) and weakens egress isolation. It also adds an internet egress dependency for API access, reducing availability if NAT/edge paths fail.

Recommendation

Use an interface VPC endpoint for the EC2 service in each VPC that requires EC2 API access.

Enable private DNS to keep calls on the AWS network
Apply restrictive endpoint policies (least privilege)
Reduce reliance on public egress and layer controls for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 create-vpc-endpoint —vpc-id <VPC_ID> —service-name com.amazonaws.<REGION>.ec2 —vpc-endpoint-type Interface —subnet-ids <SUBNET_ID>

# Create an EC2 interface VPC endpoint
resource "aws_vpc_endpoint" "<example_resource_name>" {
  vpc_id            = "<example_resource_id>"           # CRITICAL: target VPC
  service_name      = "com.amazonaws.<region>.ec2"      # CRITICAL: EC2 interface endpoint service
  vpc_endpoint_type = "Interface"                       # CRITICAL: interface endpoint
  subnet_ids        = ["<example_resource_id>"]         # CRITICAL: subnet(s) for endpoint ENIs
}

# CloudFormation: create an EC2 interface VPC endpoint in the VPC
Resources:
  VPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: "<example_resource_id>"                 # CRITICAL: target VPC for the endpoint
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ec2"  # CRITICAL: EC2 interface endpoint service
      VpcEndpointType: Interface                      # CRITICAL: create an interface endpoint
      SubnetIds:                                      # CRITICAL: subnets to place the endpoint ENIs
        - "<example_resource_id>"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_endpoint_for_ec2_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

VPC endpoint policy allows only trusted AWS accounts VPC interface endpoint has subnets in multiple AZs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires