Policies & Private Workloads
Endpoint policies, the three-layer access model, fully private Fargate endpoint requirements, and isolated-subnet S3 access.
This is the continuation of VPC Endpoints (Gateway + Interface). Complete that lab first. Your $GW_ENDPOINT_ID, $IF_ENDPOINT_ID, and $SG_ENDPOINT must be set.
Endpoint Policies and the Three-Layer Access Model
Goal
Apply a restrictive policy to prevent data exfiltration. Understand exactly which three checks must all pass for a VPC endpoint call to succeed.
Estimated time: 20 minutes
Apply a restrictive policy to the SQS endpoint
What's happening here
Endpoint policies are IAM resource-based policies scoped to the endpoint. They are evaluated in addition to the caller's IAM policy and the resource's own policy, all three must allow the action. A common hardening pattern: restrict the SQS endpoint so only queues in your account can be accessed. This blocks a classic exfiltration path: even if an attacker steals IAM credentials from a compromised ECS task, they cannot send data to an SQS queue in their own account because the endpoint policy rejects cross-account calls at the network level, before IAM even matters.