Back to Checks
aws

Amazon VPC interface endpoint has subnets in multiple Availability Zones

vpc_endpoint_multi_az_enabled
Service: vpcSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsEc2VpcEndpointService

VPC interface endpoints are evaluated for whether their endpoint network interfaces are placed in multiple subnets, which implies distribution across different Availability Zones. Endpoints present in only one subnet are identified.

Prowler logoProwlerprowler-provider-aws

Risk

A single-subnet endpoint creates a single-AZ dependency. An AZ outage or routing issue can cut access to the service, reducing availability. Workloads may revert to public endpoints, exposing traffic to the Internet and risking confidentiality through interception or tampering.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks vpc_endpoint_multi_az_enabled

Recommendation

Place interface endpoints in multiple subnets across distinct AZs to remove single-AZ reliance. Prefer zone-local routing so clients use the nearest endpoint, and combine with private DNS and restrictive security groups to limit exposure-supporting defense in depth and resilient connectivity.

Remediation

CLI

aws ec2 modify-vpc-endpoint --vpc-endpoint-id <example_resource_id> --add-subnet-ids <example_subnet_id_2>

Terraform

resource "aws_vpc_endpoint" "<example_resource_name>" {
  vpc_id            = "<example_resource_id>"
  service_name      = "com.amazonaws.<region>.<service>"
  vpc_endpoint_type = "Interface"

  subnet_ids = [
    "<example_subnet_id_1>",
    "<example_subnet_id_2>"  # CRITICAL: add a second subnet (ideally in a different AZ) to satisfy multi-AZ
  ]
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      VpcId: <example_resource_id>
      ServiceName: com.amazonaws.<region>.<service>
      SubnetIds:  # CRITICAL: include at least two subnets (preferably in different AZs) to pass the check
        - <example_subnet_id_1>
        - <example_subnet_id_2>

Other

1Open the AWS VPC console and go to Endpoints
2Select the interface endpoint
3Click Actions > Manage subnets
4Select an additional subnet in a different Availability Zone
5Click Modify subnets to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class vpc_endpoint_multi_az_enabled(Check):
    def execute(self):
        findings = []
        for endpoint in vpc_client.vpc_endpoints:
            if endpoint.vpc_id in vpc_client.vpcs and endpoint.type == "Interface":
                report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
                report.status = "FAIL"
                report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} does not have subnets in different AZs."
                if len(endpoint.subnet_ids) > 1:
                    report.status = "PASS"
                    report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} has subnets in different AZs."

                findings.append(report)

        return findings

References