Back to Checks
aws

VPC has an Amazon EC2 VPC endpoint

vpc_endpoint_for_ec2_enabled
Service: vpcSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:AwsEc2VpcEndpointService

Amazon VPCs are evaluated for an interface VPC endpoint to the Amazon EC2 API (ec2). Its presence indicates private EC2 API connectivity over AWS PrivateLink within the VPC.

Prowler logoProwlerprowler-provider-aws

Risk

Without a private EC2 endpoint, EC2 API traffic exits via IGW/NAT. This expands exposure to network path threats (e.g., DNS hijack, MITM) and weakens egress isolation. It also adds an internet egress dependency for API access, reducing availability if NAT/edge paths fail.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks vpc_endpoint_for_ec2_enabled

Recommendation

Use an interface VPC endpoint for the EC2 service in each VPC that requires EC2 API access.

  • Enable private DNS to keep calls on the AWS network
  • Apply restrictive endpoint policies (least privilege)
  • Reduce reliance on public egress and layer controls for defense in depth

Remediation

CLI

aws ec2 create-vpc-endpoint --vpc-id <VPC_ID> --service-name com.amazonaws.<REGION>.ec2 --vpc-endpoint-type Interface --subnet-ids <SUBNET_ID>

Terraform

# Create an EC2 interface VPC endpoint
resource "aws_vpc_endpoint" "<example_resource_name>" {
  vpc_id            = "<example_resource_id>"           # CRITICAL: target VPC
  service_name      = "com.amazonaws.<region>.ec2"      # CRITICAL: EC2 interface endpoint service
  vpc_endpoint_type = "Interface"                       # CRITICAL: interface endpoint
  subnet_ids        = ["<example_resource_id>"]         # CRITICAL: subnet(s) for endpoint ENIs
}

NativeIaC

# CloudFormation: create an EC2 interface VPC endpoint in the VPC
Resources:
  VPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: "<example_resource_id>"                 # CRITICAL: target VPC for the endpoint
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ec2"  # CRITICAL: EC2 interface endpoint service
      VpcEndpointType: Interface                      # CRITICAL: create an interface endpoint
      SubnetIds:                                      # CRITICAL: subnets to place the endpoint ENIs
        - "<example_resource_id>"

Other

1In the AWS console, go to VPC > Endpoints
2Click Create endpoint
3For Service category, choose AWS services and select Service name com.amazonaws.<region>.ec2
4Select your VPC and at least one subnet
5Click Create endpoint

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class vpc_endpoint_for_ec2_enabled(Check):
    def execute(self):
        findings = []
        for vpc_id, vpc in vpc_client.vpcs.items():
            if vpc_client.provider.scan_unused_services or vpc.in_use:
                report = Check_Report_AWS(metadata=self.metadata(), resource=vpc)
                report.status = "FAIL"
                report.status_extended = f"VPC {vpc.id} has no EC2 endpoint."
                for endpoint in vpc_client.vpc_endpoints:
                    if endpoint.vpc_id == vpc_id and "ec2" in endpoint.service_name:
                        report.status = "PASS"
                        report.status_extended = (
                            f"VPC {vpc.id} has an EC2 {endpoint.type} endpoint."
                        )
                        break

                findings.append(report)

        return findings

References