Check provider logo

VPC endpoint policy allows access only from trusted AWS accounts

vpc_endpoint_connections_trust_boundaries

Severityhigh
Servicevpc
by Prowler
trust-boundariesidentity-access

VPC endpoint policies are assessed for restriction to configured trusted AWS accounts. If Principal values (including *) or account ARNs permit non-trusted principals, or conditions aren't sufficiently restrictive, the endpoint is identified. Endpoints without editable policies are excluded.

Risk

Non-trusted principals using your endpoint can access AWS services as if from your VPC, weakening segmentation. This enables unauthorized reads/writes and data exfiltration from resources tied to the endpoint, harming confidentiality and integrity, and potentially increasing costs.

Run this check with Prowler CLI

prowler aws --checks vpc_endpoint_connections_trust_boundaries

Run in Prowler Cloud

Recommendation

Apply least privilege: restrict endpoint policies to your account and an explicit allowlist of trusted accounts. Avoid * principals unless coupled with strict conditions. Prevent transitive trust across network links, and use resource policies and monitoring as defense in depth to limit endpoint use.

Remediation

CLI

aws ec2 modify-vpc-endpoint --vpc-endpoint-id <example_resource_id> --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"","Action":"","Resource":"*","Condition":{"StringEquals":{"aws:PrincipalAccount":["<TRUSTED_ACCOUNT_ID_1>","<TRUSTED_ACCOUNT_ID_2>"]}}}]}'

Native IaC
Terraform
Other
  1. Open the AWS Console and go to VPC > Endpoints
  2. Select the endpoint and choose Actions > Manage policy
  3. Select Custom and paste this minimal policy, replacing with your trusted account IDs: 
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalAccount": [
            "<TRUSTED_ACCOUNT_ID_1>",
            "<TRUSTED_ACCOUNT_ID_2>"
          ]
        }
      }
    }
  ]
}
  4. Click Save

Source Code

Resource Type

AwsEc2VpcEndpointService

References