lacework-global-147
Exposed AWS Virtual Private Cloud (VPC) endpoints
Description
When creating a VPC endpoint, the default policy choice is 'full access' for any Identity and Access Management (IAM) user or service within the VPC.
{
"Statement": [
{
"Action": "*",
"Effect": "Allow",
"Resource": "*",
"Principal": "*"
}
]
}
Remediation
- Log in to the AWS Management Console.
- Select Services.
- Select VPC.
- Select Endpoints.
- Select the Endpoint to edit.
- Select the Policy tab.
- Select Edit Policy.
- Add or update the custom policy, specifying a Principal that does not give access to all users.
- Select Save.