# Ensure You Are Using VPC Endpoints for Source Code Access (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000234141-ensure-you-are-using-vpc-endpoints-for-source-code-access-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/62000112682) › [AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/folders/62000169228) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** Level 1 ### **Description:** VPC Endpoints are essential for securely accessing AWS services, such as S3 and CodeCommit, without traversing the public internet. By configuring VPC Endpoints for source code access, you can ensure that the communication between your source code repositories (like AWS CodeCommit) and your instances remains private, enhancing security and performance. ### **Rationale:** Using VPC Endpoints for source code access ensures that: - Data does not traverse the public internet, reducing the exposure of sensitive information. - Communication between services is secure and isolated from external traffic. - Better network performance by avoiding the public internet. ### **Default Value:** By default, access to services like CodeCommit may use public internet routes. Using VPC Endpoints requires manual configuration to ensure private access. **Impact:** - **Pros:** - Enhanced security by preventing traffic from going over the public internet. - Improved compliance with internal security policies that require private access. - Optimized network performance with lower latency for access to source code repositories. - **Cons:** - Requires configuration of VPC Endpoints and management of endpoint policies. - May incur additional costs for setting up and maintaining VPC Endpoints. ### **Remediation:** **Test Plan:** **Using AWS Console:** 1. Log in to the AWS Console at [AWS Console](https://console.aws.amazon.com/). 2. Navigate to VPC under Networking & Content Delivery. 3. In the Endpoints section, check if VPC Endpoints for services like CodeCommit, S3, or any other source code repositories are configured. 4. If an endpoint is not configured, create a new endpoint: - Click on Create Endpoint. - Select the appropriate service (e.g., com.amazonaws.region.codecommit). - Choose the VPC and subnets where the endpoint should be created. - Attach the necessary security group to allow access to the endpoint. 5. Once configured, verify that the endpoint is being used for source code access by attempting to access the source code repository from your instances within the VPC. **Using AWS CLI:** 1. Run the following command to list existing VPC Endpoints: aws ec2 describe-vpc-endpoints 2. Verify if there is an existing endpoint for the source code service (e.g., CodeCommit or S3). 3. If no endpoint exists, create one using the following command: aws ec2 create-vpc-endpoint --vpc-id --service-name com.amazonaws.region.codecommit --route-table-ids --subnet-ids --security-group-ids 4. Once created, confirm that the endpoint is in use by accessing the source code repository from the instance within the VPC. **Implementation Plan:** **Using AWS Console:** 1. Log in to the AWS Console at [AWS Console](https://console.aws.amazon.com/). 2. Navigate to VPC and select Endpoints. 3. Ensure that endpoints for services like CodeCommit or S3 are configured for private access. 4. If endpoints are not configured, create them by following the steps above. 5. Verify that your instances within the VPC are using these private endpoints for source code access. **Using AWS CLI:** 1. Create a VPC Endpoint for the source code service using the following command: aws ec2 create-vpc-endpoint --vpc-id --service-name com.amazonaws.region.codecommit --route-table-ids --subnet-ids --security-group-ids **Backout Plan:** **Using AWS Console:** 1. If issues arise after configuring the endpoint, log in to the AWS Console. 2. Navigate to VPC and go to Endpoints. 3. Select the problematic endpoint and delete or modify it to resolve the issue. **Using AWS CLI:** 1. If necessary, delete the VPC endpoint using the following command: aws ec2 delete-vpc-endpoint --vpc-endpoint-id **References:** - [AWS CLI: describe-vpc-endpoints ](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html) - [AWS CLI: create-vpc-endpoint ](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc-endpoint.html) - [AWS VPC Endpoints Documentation ](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html) **CIS Controls:**

Version	Control ID	Control Description
v8	3.4	Ensure VPC Endpoints are used for source code access to avoid using the public internet for critical services like CodeCommit.
v7	14.2	Implement VPC Endpoints for secure and private access to source code repositories and other critical resources.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.