AWS Console Private Access can block sign-ins to personal accounts
AWS Console Private Access goes GA, letting internet-isolated VPCs reach the console fully over PrivateLink and blocking personal account sign-ins.
AWS Console Private Access became generally available on August 28, allowing the AWS Management Console, sign-in flows, static assets, and console-only APIs to run entirely over PrivateLink endpoints from VPCs with no internet connectivity. Deployment requires three interface endpoints per Region, correct Private DNS and security group settings, and uses aws:PrincipalOrgID policies plus sign-in resource control policies to deny authentication from unexpected networks, which blocks corporate-network users from signing into personal AWS accounts. IAM Identity Center sign-in and consoles for services without PrivateLink support still need internet access, and a misconfigured policy can lock out the whole organization, so AWS recommends an excluded break-glass role; CLI and SDK SigV4 requests bypass these policies and serve as a recovery path.
- Three PrivateLink interface endpoints per Region carry console, sign-in, and console-only API traffic.
- Sign-in resource control policies reject valid credentials presented from unexpected networks.
- IAM Identity Center sign-in lacks a VPC endpoint and still crosses the public internet.
- Verify rollout via the console lock icon and CloudTrail ConsoleLogin events with populated vpcEndpointId.
- Misconfigured sign-in policies can lock out the organization; break-glass roles and SigV4 CLI provide fallback.
- Vendors
- Amazon Web Services
From the original article
2 min read at helpnetsecurity.com
The AWS Management Console now loads inside a network with no path to the public internet. Console Private Access became generally available on August 28 for virtual private clouds, the isolated networks customers run inside AWS, that have no internet connectivity at all.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.