Skip to main content

📝 AWS VPC is not configured with a VPC Endpoint for Amazon EC2 service 🟢

  • Contextual name: 📝 VPC is not configured with a VPC Endpoint for Amazon EC2 service 🟢
  • ID: /ce/ca/aws/vpc/no-ec2-vpc-endpoint
  • Located in: 📁 AWS VPC

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Logic​

Description​

Open File

Description​

Ensures that Amazon VPCs are configured with a VPC endpoint for the Amazon EC2 service. A VPC endpoint enables private connectivity between your VPC and supported AWS services without the need for an internet gateway, NAT device, VPN connection, or AWS Direct Connect.

Rationale​

Using VPC endpoints for services such as EC2 enhances security by ensuring all traffic between your VPC and the EC2 service remains within the AWS network. This prevents data exposure to the public internet, reducing the risk of interception and external attacks. Additionally, it improves reliability and helps maintain consistent network performance.

Impact​

Provisioning VPC endpoints may result in additional costs. Charges apply for each hour an interface VPC endpoint is active in an Availability Zone, as well as per GB of data processed.

Audit​

This policy flags an AWS VPC as INCOMPLIANT if it contains at least one EC2 Instance but does not contain an active VPC Endpoint with Endpoint Service ID set to ec2.

... see more

Remediation​

Open File

Remediation​

From Command Line​

Create the VPC Endpoint​
aws ec2 create-vpc-endpoint \
    --vpc-id {{vpc-id}} \
    --service-name com.amazonaws.{{region}}.ec2 \
    --subnet-ids {{subnet-id1}} {{subnet-id2}} \
    --security-group-ids {{security-group-id}}

Using CloudFormation​

  • CloudFormation template (YAML):
AWSTemplateFormatVersion: 2010-09-09
Description: Create EC2 VPC Endpoint

Parameters:
  VpcId:
    Type: String
    Description: The ID of the VPC where the endpoint will be created.
  SubnetIds:
    Type: CommaDelimitedList
    Description: Comma-separated list of subnet IDs for the VPC endpoint.
  SecurityGroupIds:
    Type: CommaDelimitedList
    Description: Comma-separated list of security group IDs to associate with the VPC endpoint.

Resources:
  EC2VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ec2"
      SubnetIds: !Ref SubnetIds
      SecurityGroupIds: !Ref SecurityGroupIds

Outputs:
  VpcEndpointId:
    Description: The ID of the created VPC endpoint

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service1
💼 Cloudaware Framework → 💼 Secure Access54
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3767
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23678
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1145
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81156
💼 FedRAMP High Security Controls → 💼 AC-21 Information Sharing (M)(H)8
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10848
💼 FedRAMP High Security Controls → 💼 SC-7(3) Access Points (M)(H)8
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)28
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)8
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)22
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)33
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)163
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)45
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)656
💼 FedRAMP Moderate Security Controls → 💼 AC-21 Information Sharing (M)(H)8
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)742
💼 FedRAMP Moderate Security Controls → 💼 SC-7(3) Access Points (M)(H)8
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)28
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events118
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events137
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained48
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties91
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected117
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected97
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected111
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage69
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15537
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control14
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement326888
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3745
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102349
💼 NIST SP 800-53 Revision 5 → 💼 AC-21 Information Sharing28
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29450
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(3) Boundary Protection _ Access Points8
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services28
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic22
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components23
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation8
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components22