Security Group for VPC Endpoint does not have any Ingress rules.

[joehillen]

I lost almost 2 days trying to figure out why a VPC Endpoint for Secrets Manager I created was totally unreachable.

It turns out that the default security group created for the endpoint does not have any ingress rules. Making the vpce totally unless.

Reproduction Steps

1. Create a VPC.
2. Add an AWS VPC Interface Endpoint.
3. Try to connect to it.

Environment

• CLI Version : 1.15.0
• Framework Version: 1.15.0
• OS : Linux
• Language : TypeScript

Workaround

The workaround is to create the endpoint and then use:

ep.connections.allowDefaultPortFromAnyIpv4()

---

This is 🐛 Bug Report

[rix0rrr]

I am sorry that it was not documented well enough that endpoints come without default security rules, and that it cost you a lot of time. I'm not sure I'd consider it a bug, but I'm open to changing this so that it works out of the box.

[joehillen]

@rix0rrr Thank you for considering this.

Allowing ingress as I do #4938 I think would be the expected behavior. Most users will not need to lock down VPC Endpoints and those that do can define their own security group and pass to the VPC endpoint during creation. I don't agree with the addition of the open flag, as that only complicates the interface for no benefit and setting open = false creates an endpoint that can't be used by anything.

Setting the connection as suggested is unnecessary and runs the risk of messing with a user specified security group.

[NullPtrException]

That only complicates the interface for no benefit and setting open = false creates an endpoint that can't be used by anything.

That all depends on what the endpoint/interface is being used for, if you’re seeking to allow calls into the VPC by something else, unprompted then you're correct. That is if you’re hosting a service within a VPC and want to allow calls into it, then you’re absolutely right that the default security group of no ingress, all egress is unusable.

However, if all your interface/endpoint is used for is to call other AWS services, the default Security Group does work. Security Groups are stateful, see: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison?tag=affiliate-income-20 this means that even if ingress is disallowed, so long as the ingress is just return traffic, it’s automatically approved regardless of rules. This means should your endpoint be used to call out into S3 and the like, the return response will be allowed so long as egress traffic is allowed.

So, the state of allowing ingress traffic all depends on what the endpoint is going to be used for.