cyber.hendryadrian.com
Security News · helpnetsecurity.com

AWS Makes Console Private Access Generally Available for Isolated VPCs

· Original article ↗

Summary

AWS Console Private Access is generally available, routing supported console traffic through PrivateLink in isolated VPCs and allowing policies to restrict sign-ins from unexpected networks. IAM Identity Center sign-in still requires public internet access.

Key points

  • Console Private Access became generally available on August 28 for VPCs without internet connectivity.
  • Console pages, sign-in flows, console-only APIs, and supported service API calls travel through PrivateLink endpoints.
  • Three interface endpoints per Region are required; private DNS and security group rules must also be configured.
  • Endpoint and sign-in resource control policies can restrict console access to organizational identities and deny authentication from unexpected networks, including sign-ins to personal accounts from a corporate network.
  • IAM Identity Center sign-in still uses the public internet, and supported service consoles require their own endpoints.
  • A misconfigured sign-in policy can lock an organization out of the console; AWS recommends configuring an excluded break-glass role before enforcement.
  • CLI and SDK requests signed with SigV4 are unaffected by these policies and can provide a way back in.

Article Details

Event Type
General availability announcement for AWS Console Private Access
Impact
Enables supported AWS Management Console pages, sign-in flows, and service API calls to operate in isolated VPCs through PrivateLink endpoints. Endpoint policies can restrict console access to organizational identities and prevent sign-ins to personal accounts from corporate networks. IAM Identity Center sign-in and some unsupported services still require public internet access; misconfigured sign-in policies can lock an organization out of the console.

Vendors

Amazon Web ServicesAWS Console Private Access is now generally available, letting the AWS Management Console load entirely within no-internet VPCs through PrivateLink endpoints.

Products

AWS Console Private AccessAWS Console Private Access is now generally available, letting the AWS Management Console load entirely within no-internet VPCs through PrivateLink endpoints.AWS Management ConsoleAWS Console Private Access is now generally available, letting the AWS Management Console load entirely within no-internet VPCs through PrivateLink endpoints.AWS PrivateLinkAWS Console Private Access is now generally available, letting the AWS Management Console load entirely within no-internet VPCs through PrivateLink endpoints.IAM Identity CenterIt strengthens access control in regulated environments by blocking sign-ins from the wrong network, while some services and IAM Identity Center still require public internet access.

Related Articles