The failure modes here are quiet, which is exactly why they need planning around. If private DNS does not resolve the console domains to the interface endpoints, or the endpoint security groups do not allow HTTPS from the workload subnets, the connection fails silently [5]. If a per-service endpoint is missing, the page still renders: one console page often calls several service APIs, so the symptom is an empty panel [12], and opening the KMS console without a KMS endpoint leaves the key list hanging [11]. Two positive signals confirm the traffic actually stayed inside: a lock icon in the console navigation bar, and CloudTrail ConsoleLogin events with the vpcEndpointId field populated [6]. The lock icon only tells the person at the keyboard; the CloudTrail field is the one an audit can rely on.
Endpoint arithmetic sets the bill. Three interface endpoints per Region cover the console, sign-in, and console-only APIs, with the third required only in a VPC that has no internet path [4]. Each supported service console needs its own endpoint on top of those three [11], and every endpoint bills at standard PrivateLink rates, per Region [14]. A team offering four service consoles across two Regions is standing up (3 + 4) x 2 = 14 endpoints before anyone signs in [17].
The insider-control effect originates in the policy layer that sits above the endpoints. Endpoint policies keyed on aws:PrincipalOrgID and aws:ResourceOrgID restrict which identities can reach the console from your network and which resources those sessions can touch [7], and sign-in resource control policies deny authentication that arrives from an unexpected network [8]. Per Help Net Security's account of the feature, credentials that are valid but presented from the wrong place get refused at the sign-in step, before the console loads, which is what stops an employee using the corporate network to sign into a personal AWS account and walk data out through the browser [9]. That moves a data-loss problem previously handled by proxy allowlists and browser controls into the network path itself.
One documented exception sits at the front door: IAM Identity Center sign-in has no VPC endpoint yet, so initial single sign-on still crosses the public internet [10]. Shops standing on Identity Center get a private console with a public authentication hop.
The lockout risk is ordinary and severe. A misconfigured sign-in policy locks the whole organization out of the console, so the excluded break-glass role has to exist before enforcement is turned on [15]. The recovery path is CLI and SDK calls signed with SigV4, which these policies do not cover [16].
