VPC interface endpoint has subnets in multiple AZs

Check ID: vpc_endpoint_multi_az_enabled
Provider: AWS
Service: vpc
Severity: MEDIUM
Categories: resilience
Resource type: AwsEc2VpcEndpointService

What this check verifies

VPC interface endpoints are evaluated for whether their endpoint network interfaces are placed in multiple subnets, which implies distribution across different Availability Zones. Endpoints present in only one subnet are identified.

Risk

A single-subnet endpoint creates a single-AZ dependency. An AZ outage or routing issue can cut access to the service, reducing availability. Workloads may revert to public endpoints, exposing traffic to the Internet and risking confidentiality through interception or tampering.

Recommendation

Place interface endpoints in multiple subnets across distinct AZs to remove single-AZ reliance. Prefer zone-local routing so clients use the nearest endpoint, and combine with private DNS and restrictive security groups to limit exposure-supporting defense in depth and resilient connectivity.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 modify-vpc-endpoint —vpc-endpoint-id <example_resource_id> —add-subnet-ids <example_subnet_id_2>

resource "aws_vpc_endpoint" "<example_resource_name>" {
  vpc_id            = "<example_resource_id>"
  service_name      = "com.amazonaws.<region>.<service>"
  vpc_endpoint_type = "Interface"

  subnet_ids = [
    "<example_subnet_id_1>",
    "<example_subnet_id_2>"  # CRITICAL: add a second subnet (ideally in a different AZ) to satisfy multi-AZ
  ]
}

Resources:
  <example_resource_name>:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      VpcId: <example_resource_id>
      ServiceName: com.amazonaws.<region>.<service>
      SubnetIds:  # CRITICAL: include at least two subnets (preferably in different AZs) to pass the check
        - <example_subnet_id_1>
        - <example_subnet_id_2>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_endpoint_multi_az_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

VPC has an Amazon EC2 VPC endpoint VPC endpoint service allows only trusted principals or none

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires