VPC Endpoints Pack

7 VPC Endpoints in One CloudFormation Stack

A single CloudFormation stack that deploys all the VPC endpoints your services need to talk to AWS APIs without going through the internet — S3, DynamoDB, SSM, Secrets Manager, ECR API, ECR DKR, and CloudWatch Logs, wired to your subnets and route tables automatically.

What's Included

• Gateway endpoints for S3 and DynamoDB (free, route-table-based)
• Interface endpoints for SSM, Secrets Manager, ECR API, ECR DKR, and CloudWatch Logs
• Security group for interface endpoints allowing HTTPS from your VPC CIDR
• Private DNS enabled on all interface endpoints
• Route table associations for gateway endpoints across all specified subnets
• Outputs with endpoint IDs and DNS names for reference

What You Get

• vpc-endpoints.yaml — CloudFormation template with all 7 endpoints
• parameters/ — parameter files for single-AZ and multi-AZ subnet configurations
• README.md — cost breakdown (gateway = free, interface = ~/mo each), endpoint DNS behavior, and IAM policy examples that restrict S3 access to endpoint-only

Requirements

• AWS account with CloudFormation and EC2:VpcEndpoint permissions
• Existing VPC with private subnets
• Route table IDs for gateway endpoint associations (subnet IDs for interface endpoints)