A team creates a new interface VPC endpoint for an AWS service and does not attach any custom endpoint policy to it. Immediately after creation, what access does the endpoint grant by default?
- No access at all; every interface VPC endpoint starts with an implicit deny-all policy and requires a custom policy to be attached before any traffic is allowed through it
- Full access; the default endpoint policy allows all principals to perform all actions on the service through the endpoint, equivalent to how the service behaves without a VPC endpoint at all, subject to any other IAM or resource policies that would otherwise apply
- Access limited to the AWS account that owns the VPC, but no other accounts, even if those other accounts' principals would otherwise be authorized by IAM
- Access limited strictly to read-only API actions until a custom policy explicitly grants write actions
Why B? And why not the others?
Correct answer: B. Full access; the default endpoint policy allows all principals to perform all actions on the service through the endpoint, equivalent to how the service behaves without a VPC endpoint at all, subject to any other IAM or resource policies that would otherwise apply
If you don't attach a policy when you create an interface VPC endpoint, AWS attaches a default endpoint policy for you that allows full access: all principals can perform all actions on the service through that endpoint, the same as if the traffic weren't going through a VPC endpoint at all, and this is still subject to whatever other IAM identity-based or resource-based policies would otherwise apply, since an endpoint policy works alongside those rather than replacing them. The 'implicit deny-all' option is wrong because it describes the opposite of AWS's documented default; a brand-new endpoint with no custom policy is maximally permissive, not locked down. The 'limited to the VPC's own account' option is wrong because the default full-access policy doesn't restrict by account at all — cross-account access is governed by whatever IAM or resource policies would already apply, not by an account-scoping rule baked into the endpoint's default policy. The 'read-only until write is granted' option is wrong because the default policy makes no distinction between read and write actions; it permits every action by default until a custom policy is written to narrow it.
Source: AWS PrivateLink Guide: Control access to VPC endpoints using endpoint policies — 'If you don't attach an endpoint policy... we attach the default endpoint policy... to allow full access to the service.'