All checks
Medium
Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
Confirms that each VPC with EC2 instances has an interface endpoint for the EC2 service, so the instances' EC2 API calls stay on the AWS network. Only the endpoint's existence is read, not its state, policy or DNS settings. A VPC shared in from another account is its owner's to fix; suppress the finding in this account.
- service
- EC2
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
VPC → Endpoints → Create endpoint
With the AWS CLI
aws ec2 create-vpc-endpoint --vpc-id <vpc-id> --vpc-endpoint-type Interface --service-name com.amazonaws.<region>.ec2 --subnet-ids <subnet-id> --security-group-ids <security-group-id> --private-dns-enabled --region <region>With Terraform
resource "aws_vpc_endpoint" "this" {
vpc_id = var.vpc_id
service_name = "com.amazonaws.${var.region}.ec2"
vpc_endpoint_type = "Interface"
subnet_ids = var.subnet_ids
security_group_ids = var.security_group_ids
private_dns_enabled = true
}See which of your accounts this check is failing on.
Book a demo