Amazon VPCs are evaluated for an interface VPC endpoint to the Amazon EC2 API (ec2). Its presence indicates private EC2 API connectivity over AWS PrivateLink within the VPC.
Risk
Without a private EC2 endpoint, EC2 API traffic exits via IGW/NAT. This expands exposure to network path threats (e.g., DNS hijack, MITM) and weakens egress isolation. It also adds an internet egress dependency for API access, reducing availability if NAT/edge paths fail.
prowler aws --checks vpc_endpoint_for_ec2_enabled
Recommendation
Use an interface VPC endpoint for the EC2 service in each VPC that requires EC2 API access.
- Enable private DNS to keep calls on the AWS network
- Apply restrictive endpoint policies (least privilege)
- Reduce reliance on public egress and layer controls for defense in depth
Remediation
aws ec2 create-vpc-endpoint --vpc-id <VPC_ID> --service-name com.amazonaws.<REGION>.ec2 --vpc-endpoint-type Interface --subnet-ids <SUBNET_ID>
- In the AWS console, go to VPC > Endpoints
- Click Create endpoint
- For Service category, choose AWS services and select Service name com.amazonaws.<region>.ec2
- Select your VPC and at least one subnet
- Click Create endpoint
Source Code
Resource Type
AwsEc2VpcEndpointService