Profile Applicability:

  • Level 1

Description:
 VPC endpoints allow private connections between your VPC and supported AWS services, ensuring that traffic does not traverse the public internet. This improves security and reduces latency by keeping the traffic within the AWS network.

Rationale:
 Configuring VPC endpoints provides a secure, private connection to AWS services, preventing exposure to the public internet. This mitigates potential vulnerabilities that could arise from using public IP addresses and enhances network security.

Impact:
 Without proper VPC endpoint configuration, traffic to AWS services may be routed over the public internet, exposing it to potential security risks. It also can lead to higher latency and less control over traffic management.

Default Value:
 By default, AWS services require internet access via NAT gateways or public IPs unless VPC endpoints are manually configured.

Pre-requisites:

  • An AWS account with appropriate permissions.

  • A Virtual Private Cloud (VPC) with necessary subnets.

  • Understanding of the AWS services requiring endpoints (e.g., S3, DynamoDB).

Remediation:

Test Plan:

Using AWS Console:

  1. Sign in to the AWS Management Console.

  2. Navigate to VPC > Endpoints.

  3. Verify that the required VPC endpoints are configured for services like S3 or DynamoDB.

  4. Check if the Service Name matches the necessary AWS services (e.g., com.amazonaws.s3 for S3).

  5. Review the Route Tables to ensure the correct subnet associations.

Using AWS CLI:

  1. Run the following command to list existing VPC endpoints:

     aws ec2 describe-vpc-endpoints

  2. Verify that the endpoints are associated with the correct VPC and subnets.

  3. Check the service names for each endpoint using:

     aws ec2 describe-vpc-endpoint-services

Implementation Plan

Using AWS Console:

  1. Go to VPC Dashboard and select Endpoints under Virtual Private Cloud.

  2. Click Create Endpoint.

  3. Select the service to create the endpoint for (e.g., S3).

  4. Choose the VPC and subnets to associate with the endpoint.

  5. Select Private for DNS Name to ensure traffic stays within AWS's network.

  6. Review and click Create Endpoint.

Using AWS CLI:

  1. Create a VPC endpoint for S3 using the following command:

    aws ec2 create-vpc-endpoint --vpc-id <vpc-id> --service-name com.amazonaws.s3 --route-table-ids <route-table-id> --vpc-endpoint-type Interface

  2. If you need to create a Gateway endpoint for DynamoDB:

     aws ec2 create-vpc-endpoint --vpc-id <vpc-id> --service-name com.amazonaws.dynamodb --route-table-ids <route-table-id> --vpc-endpoint-type Gateway

Backout Plan

Using AWS Console:

  1. Navigate to VPC > Endpoints.

  2. Select the endpoint you want to remove.

  3. Click Delete to remove the endpoint from your VPC.

Using AWS CLI:

  1. Delete the VPC endpoint using the following command:

     aws ec2 delete-vpc-endpoint --vpc-endpoint-id <vpc-endpoint-id>

References: