cis-aws-foundations-6-8

name	cis-aws-foundations-6.8
description	Ensure VPC Endpoints are used for access to AWS Services
category	cis-networking
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","networking","vpc","vpc-endpoints","privatelink","s3","dynamodb"]
cis_id	6.8
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-6.5","cis-aws-foundations-6.6"]
prerequisites	[]
severity_boost	{}

Ensure VPC Endpoints are used for access to AWS Services

Description

Ensure that Amazon VPCs use VPC endpoints (gateway or interface endpoints) for access to AWS services such as Amazon S3 and DynamoDB, so that traffic from workloads to AWS services stays on the Amazon private network instead of traversing the public internet. VPC endpoints provide private connectivity between VPCs and supported AWS services without requiring an internet gateway, NAT gateway, or public IP addresses.

Rationale

Accessing AWS services over the public internet increases exposure to network-level threats, relies on internet routing, and makes it harder to tightly control egress paths. Using VPC endpoints allows workloads to reach AWS services over the Amazon private network, which reduces reliance on internet gateways and NAT gateways, simplifies egress filtering, and helps enforce data-perimeter and "private-only" patterns for sensitive workloads.

Impact

Enforcing the use of VPC endpoints may require changes to existing network architectures, including creating and managing endpoints in each VPC, updating route tables, adjusting security groups, and potentially removing or tightening some internet/NAT gateway paths. This can introduce additional operational overhead and cost (per-endpoint charges for interface endpoints) and may require updates to IaC templates and deployment pipelines.

Audit Procedure

Using AWS CLI

1. Identify in-scope VPCs and services.

   • Determine which VPCs host production or sensitive workloads that should access AWS services securely via endpoints.
   • For those VPCs, identify the AWS services they depend on (for example, S3 for data storage, DynamoDB for database, etc.).

2. For each in-scope VPC, check for existing VPC endpoints:

aws ec2 describe-vpc-endpoints \
  --region REGION \
  --filters "Name=vpc-id,Values=VPC_ID" \
  --query "VpcEndpoints[*].[VpcEndpointId,VpcEndpointType,ServiceName,State]" \
  --output table

• Provide the REGION and VPC_ID.
• VpcEndpointType tells you whether the endpoint is Gateway or Interface.
• ServiceName shows which AWS service the endpoint is for (for example, com.amazonaws.us-east-1.s3, com.amazonaws.us-east-1.dynamodb, com.amazonaws.us-east-1.ssm).

3. For each interface endpoint, verify subnet attachment across relevant AZs/subnets:

aws ec2 describe-vpc-endpoints \
  --region REGION \
  --vpc-endpoint-ids INTERFACE_ENDPOINT_ID \
  --query "VpcEndpoints[*].[VpcEndpointId,ServiceName,SubnetIds,State]" \
  --output json