Check ID: vpc_endpoint_services_allowed_principals_trust_boundaries
Provider: AWS
Service: vpc
Severity: HIGH
Categories: trust-boundaries
Resource type: AwsEc2VpcEndpointService

​
What this check verifies

VPC endpoint services are assessed for their allowed principals, comparing each to a configured set of trusted accounts and identifying any untrusted principals or a wildcard * present in the allowlist.

​
Risk

Untrusted or wildcard principals can create PrivateLink connections to your service, eroding segmentation. This enables unauthorized data access (confidentiality), abuse of internal APIs (integrity), and excess load on backends (availability).

​
Recommendation

Apply least privilege: restrict allowed principals to vetted account IDs and avoid *. Maintain a central trust registry, enforce separation of duties with approval workflows, and review entries regularly. Use defense in depth with strong service authentication and continuous configuration monitoring.

​
Remediation

# Allow only a trusted principal (delete this resource to allow none)
resource "aws_vpc_endpoint_service_allowed_principal" "<example_resource_name>" {
  service_id    = "<example_resource_id>"
  principal_arn = "arn:aws:iam::<TRUSTED_ACCOUNT_ID>:root"  # CRITICAL: only this trusted account can create endpoints
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_endpoint_services_allowed_principals_trust_boundaries. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks