Access Services Privately with a VPC Endpoint

Create a VPC endpoint so traffic to S3 or DynamoDB stays on the AWS network and never traverses the public internet.

~20 mincloudvpcendpoint

Task

Configure aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID so the cloud resource enforces the control automatically without manual console steps.

When to use this

An audit finds that aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID was configured manually and drifted, leaving a resource exposed for two weeks.

Prerequisites

Terraform or IaC tooling installed
Cloud provider credentials with target permissions

Steps

1. Configure aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID in the project configuration file with the recommended defaults.

aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID

Expected output: The configuration is accepted and aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID runs without errors on the first invocation.

2. Run the check locally to verify aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID produces the expected result before pushing.

pnpm test

Expected output: Local run matches CI behavior; no surprises after push.

3. Add the gate to the CI pipeline so aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID blocks merge on failure.

- name: Run add vpc endpoint private access
  run: pnpm test

Expected output: Pull requests with failing aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID are blocked from merging.

Troubleshooting

Problem

The check passes locally but fails in CI

Solution

Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.

Problem

Configuration is rejected with a schema error

Solution

Check the tool version matches the config schema; older versions may not support newer fields.

Limitations

The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
Configuration drift is possible if someone edits settings outside version control.

Codify the control

Start by measuring the problem. Create a VPC endpoint so traffic to S3 or DynamoDB stays on the AWS network and never traverses the public internet. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run aws ec2 create-vpc-endpoint –vpc-id $VPC_ID –service-name com.amazonaws.s3 –route-table-ids $RT_ID against the current codebase and inspect the output before wiring it into CI.

aws ec2 create-vpc-endpoint --vpc-id $VPC_ID --service-name com.amazonaws.s3 --route-table-ids $RT_ID

Detect drift

Once the gate is in place, make failures actionable. A failing aws ec2 create-vpc-endpoint –vpc-id $VPC_ID –service-name com.amazonaws.s3 –route-table-ids $RT_ID should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.