AWS VPC Endpoint is NOT a security topic!?
Tags: aws, security, networking
Published: 2024-02-16 20:31:50

This article demystifies the security and performance implications of using AWS VPC Endpoints.

**Spoiler:** This is not about security for me.

Indeed, many companies have compliance constraints that mandate the implementation of an [air-gapped](https://en.wikipedia.org/wiki/Air_gap_(networking)) environment.

Let's take a closer look at how VPC endpoints work.

## Start with official AWS documentation
**VPC Endpoint definition from AWS**
[VPC Endpoint doc](https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html)

![AWS VPC Endpoints security](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tn2hsoguex48eiqcwy82.png)

Takeaways from the docs:

- Traffic stays on the AWS Network
- Prevent availability risks or bandwidth constraints
- Use AWS PrivateLink

**AWS PrivateLink**
If you're looking for VPC endpoints, you quickly come across the concept of AWS PrivateLink.
[PrivateLink doc](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rsao4amoq0cxzkzlaz6y.png)

## Do we exit the AWS network without an endpoint?

AWS PrivateLink supports many [AWS services](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html). For this test, we will use [SSM](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html) (System Manager).

Below are two diagrams showing the difference between having an endpoint and not having one.
![AWS VPC Endpoints](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/562qn4ijjup5mz3g21uy.png)

**Let's test it with the traceroute command!**

Below are the results indicating the hops traversed from an EC2 instance to the SSM endpoint.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/spqpp40fq4cq3fu1h9cc.png)

If we analyze the IP addresses of each hop. There is no IP outside of the AWS network. This is why we can conclude that we stay on the AWS network.

You can check below the reference of the RFC mentioned:

- Network class E: [RFC1112](https://www.rfc-editor.org/rfc/rfc1112#section-4)
- CGNAT Shared Space: [RFC6598](https://datatracker.ietf.org/doc/html/rfc6598)

This last one is pretty interesting because AWS recommends using it in case of [IP exhaustion for EKS](https://aws.amazon.com/blogs/containers/addressing-ipv4-address-exhaustion-in-amazon-eks-clusters-using-private-nat-gateways/).

What is intriguing here is the use of unusual CIDR blocks internally by AWS.

## Are we experiencing better latency with the endpoint?

**How to test this?**

With a bash script of course :)

The following script measures the average latency of HTTP requests to the SSM endpoint over **30 minutes**. It records timing metrics for each request and calculates the average latency from the results. Thanks to ChatGPT for the curl options.

```
end_time=$((SECONDS+1800)) 
while [ $SECONDS -lt $end_time ]; do
   curl -o /dev/null -s -w 'Connect: %{time_connect} TTFB: %{time_starttransfer} Total time: %{time_total}\n' https://ssm.eu-west-1.amazonaws.com;
   sleep 2; 
done >> output.log
count_lines=$(awk '{print $NF}' output.log | wc -l)
sum_lines=$(awk '{print $NF}' output.log | paste -sd+ - | bc)
average=$(echo "scale=4; $sum_lines / $count_lines" | bc)
echo "Average Latency: $average"
```

**Result**
- **WITHOUT** endpoint --> ~55ms
- **WITH** endpoint --> ~55ms

About bandwidth, based on a real-world use case using Athena with and without an endpoint, the performance remained the same.

## Observation

Based on these tests we can conclude that network security and performance are the same with and without an endpoint.

AWS constructed its infrastructure using public DNS, but resolving a public IP doesn't necessarily mean traversing the internet to access it.

_Example:_
If you create a private load balancer on AWS, its DNS name is publicly resolvable.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sob3hrgxzf49nm1eok6r.png)

## Take Aways

Now, if using an endpoint is not focused on security or performance, which criteria can we rely on?

Let's delve into this topic in the next article of this series.