Scope
This guide explains how to implement AWS Management Console Private Access in network-isolated environments where internet connectivity is restricted by regulatory or security policies. You'll find requirement mappings for FedRAMP Moderate/High baselines, NIST SP 800-53 Rev 5 boundary protection controls, and CMMC Level 2 network segmentation practices. This guide addresses VPC endpoint configuration, policy layering, and traffic flow verification for environments that must demonstrate complete network isolation during assessment.
Key Concepts and Definitions
AWS Management Console Private Access: This capability routes all console traffic, including authentication flows, static assets, console-only APIs, and service API calls, through AWS PrivateLink VPC endpoints. It's available in all AWS commercial Regions for supported service consoles.
Network-isolated environment: A VPC configuration without an internet gateway, NAT gateway, or route to the public internet. Traffic exits only through AWS Direct Connect, AWS Site-to-Site VPN, or AWS PrivateLink endpoints.
Data perimeter: The combination of identity, resource, and network controls that define which principals can access which resources from which networks. Implemented through Service Control Policies, Resource Control Policies, VPC endpoint policies, and sign-in policies.
Console VPC endpoint: com.amazonaws.<region>.console, routes browser requests for the console service.
Sign-In VPC endpoint: com.amazonaws.<region>.signin, handles authentication flows and credential exchange.
Console API VPC endpoint: com.amazonaws.<region>.console-static, serves static content and console-only API calls in VPCs without internet paths.
Requirements Breakdown
FedRAMP Moderate and High
SC-7 Boundary Protection: FedRAMP baselines require monitoring and controlling communications at external boundaries. Private Access removes the need for allowlisted public domains or TLS-intercepting proxies, simplifying your boundary control documentation. Your System Security Plan can now describe console access as fully contained within your VPC boundary.
AC-17 Remote Access: When operators connect through AWS Direct Connect or Site-to-Site VPN to reach the console, you must show that the access path doesn't traverse untrusted networks. Private Access provides that path; document it in your remote access procedures and reference the VPC endpoint IDs in your authorization boundary diagrams.
SC-7(4) External Telecommunications Services: If you're using Direct Connect for connectivity, Private Access traffic flows over that same link, eliminating the need for a separate internet circuit for console operations.
NIST SP 800-53 Rev 5
SC-7(20) Dynamic Isolation: Supports the ability to dynamically isolate information systems from other systems. VPC endpoint policies with aws:ResourceOrgID conditions enforce dynamic isolation by blocking console access to resources outside your organization.
AC-4 Information Flow Enforcement: Console traffic is subject to the same VPC endpoint policies that govern your API traffic. Sign-in Resource Control Policies add a pre-authentication enforcement point.
AC-6(9) Log Use of Privileged Functions: CloudTrail ConsoleLogin events now include vpcEndpointId when users authenticate through Private Access endpoints, providing verifiable evidence that privileged console sessions originated from expected networks.
CMMC Level 2
AC.L2-3.1.1 Authorized Access Control: Private Access supports the requirement to limit information system access to authorized users by restricting which AWS accounts can be accessed from your network. Attach a VPC endpoint policy that denies sign-in to accounts outside your organization.
SC.L2-3.13.1 Boundary Protection: Aligns with the requirement to monitor and control communications at the external boundary by eliminating internet-facing console traffic.
Implementation Guidance
Phase 1: Baseline and Scope
Run this CloudTrail Insights query to understand current console access patterns:
eventName = ConsoleLogin
Review sourceIPAddress, vpcEndpointId, and userIdentity.type over 30 days. Identify which organizational units rely on console access and which identity types they use (IAM users, SAML federation, IAM Identity Center).
Select a non-production organizational unit for your pilot. You're testing policy enforcement that can lock users out; don't start with production accounts.
Phase 2: Create VPC Endpoints
In your pilot Region, create three interface VPC endpoints in a VPC that has connectivity to your corporate network (via Direct Connect or Site-to-Site VPN):
com.amazonaws.<region>.consolecom.amazonaws.<region>.signincom.amazonaws.<region>.console-static(required only if no internet path exists)
Enable private DNS for each endpoint. This modifies Route 53 resolution so that .console.aws.amazon.com and .signin.aws.amazon.com resolve to your endpoint's private IP addresses instead of public AWS IPs.
If you're using a corporate DNS forwarder, configure it to forward queries for AWS console domains to a Route 53 Resolver inbound endpoint in your VPC.
Phase 3: Layer VPC Endpoint Policies
Start with a permissive policy during initial testing, then tighten incrementally:
Initial policy (validation phase):
{
"Statement": [{
"Effect": "Allow",
"Principal": "*",
"Action": "*",
"Resource": "*"
}]
}
Hardened policy (enforcement phase):
{
"Statement": [{
"Effect": "Deny",
"Principal": "*",
"Action": "*",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:ResourceOrgID": "o-yourorgid"
}
}
}]
}
This condition blocks console access to AWS accounts outside your organization, preventing operators from signing into personal accounts or external accounts from your network.
Phase 4: Configure Sign-In Resource Control Policies
Sign-in RCPs enforce network restrictions before authentication completes. Attach this policy at the organizational unit level:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "signin:ConsoleLogin",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:SourceVpc": ["vpc-yourpilot"]
}
}
}]
}
This denies console login attempts that don't originate from your expected VPC. The aws:SourceVpc condition key is available when traffic flows through a VPC endpoint.
Phase 5: Implement Break-Glass Access
Before you enforce network-restricted sign-in policies, create a break-glass principal that's exempt from the network perimeter controls:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "signin:ConsoleLogin",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:SourceVpc": ["vpc-yourpilot"]
},
"StringNotLike": {
"signin:PrincipalArn": "arn:aws:iam::*:role/BreakGlassRole"
}
}
}
]
}
Note that signin:PrincipalArn is only available for exemptions in pre-authentication statements. Store credentials for this role in a secure, out-of-band location (not in AWS Secrets Manager).
Phase 6: Verify Traffic Flow
From a workstation connected to your VPC (Amazon WorkSpaces, EC2 instance, or on-premises system via Direct Connect):
- Open a browser and navigate to
https://<region>.console.aws.amazon.com - Complete authentication
- Review CloudTrail for the
ConsoleLoginevent - Confirm
vpcEndpointIdis populated with your console endpoint ID - Confirm
sourceIPAddressshows your VPC's private IP range
If vpcEndpointId is absent, DNS isn't resolving to your endpoint. Check private DNS settings and your DNS forwarder configuration.
Common Pitfalls
Private DNS conflicts: If you've already created VPC endpoints for AWS services with private DNS enabled, the console endpoints may conflict with existing DNS records. Verify that your VPC's DNS resolver can handle multiple overlapping private hosted zones.
Incomplete endpoint coverage: The console makes API calls to multiple AWS services on your behalf. If you have a network perimeter SCP that conditions on aws:SourceVpc, you must create VPC endpoints for every service your operators use through the console. Otherwise, those API calls fail even though the console loads.
Sign-in RCP scope errors: RCPs applied at the management account level affect all accounts in the organization, including the management account itself. Test RCPs in a non-production organizational unit first. If you lock yourself out of the management account, you'll need AWS Support intervention.
Missing break-glass exemption: Sign-in policies that restrict network location must include an exemption for at least one principal. If your Direct Connect link fails and your VPN is unavailable, you need a way to authenticate from an alternate network to restore service.
Overly broad aws:SourceVpce conditions: AWS recommends conditioning on aws:SourceVpc rather than specific aws:SourceVpce values. If you replace or recreate an endpoint, policies that reference the old endpoint ID will break until you update them.
Quick Reference Table
| Control Objective | Policy Type | Condition Key | Enforcement Point |
|---|---|---|---|
| Only trusted identities can access my resources | Sign-In RCP | aws:PrincipalOrgID, aws:PrincipalAccount |
Pre-authentication and post-authentication |
| Only trusted identities from my network | Console VPC endpoint policy | aws:PrincipalOrgID, aws:PrincipalAccount |
Console endpoint evaluation |
| My identities access only trusted resources | Service Control Policy | aws:ResourceOrgID |
Every service API call |
| Only trusted resources accessed from my network | Console VPC endpoint policy | aws:ResourceOrgID, aws:ResourceAccount |
Console endpoint evaluation |
| My identities access resources only from expected networks | Service Control Policy | aws:SourceVpc |
Service API call evaluation |
| My resources accessed only from expected networks | Sign-In RCP | aws:SourceVpc, aws:SourceVpce, aws:VpcSourceIp |
Console authentication |
CloudTrail verification fields:
eventName: ConsoleLoginvpcEndpointId: Populated when traffic flows through Private Access endpointsourceIPAddress: VPC private IP when accessed through endpointuserIdentity.principalId: Identity that authenticated
Required VPC endpoints for full isolation:
- Console:
com.amazonaws.<region>.console - Sign-In:
com.amazonaws.<region>.signin - Console API:
com.amazonaws.<region>.console-static
