Static assets are the whole delta. The 2023 launch already routed console, sign-in and service API calls through VPC endpoints, and left the JavaScript, CSS and images that render the UI, plus the console-only APIs, needing internet connectivity [5]. That is why the workaround in isolated environments was a maintained domain allowlist or a TLS-intercepting proxy, both of which AWS now lists as things you no longer have to operate [7]. Of the four traffic categories in the GA announcement, those two are the ones that changed state [13].
The choice AWS describes is one every reviewer in a regulated shop has signed off on at least once: permit egress so operators can use the console, or deny the console and hand them a CLI-only workflow [6]. Usually the exception got written, with a compensating control and a renewal date.
AWS says the private path eliminates the need for an internet gateway, NAT gateway, or any route to the public internet [3], and that claim is worth checking against its actual scope. It covers the enumerated console traffic for a select set of supported service consoles, and the announcement text does not name which ones [2][4]. So the NAT gateway leaves your operator subnet only if two conditions both hold: every console those operators open is in the supported set, and nothing else in that subnet, agent or package source or otherwise, was quietly sharing the same route [15]. Whatever the original justification for keeping that NAT gateway was, this is the test it now has to pass.
The access-control half is worth reading separately from the connectivity half, because the two policies answer different questions. A VPC endpoint policy with an `aws:ResourceOrgID` condition scopes console actions to resources inside your organization, which is what stops a browser in your VPC being used to drive a personal account [10]. A sign-in resource control policy checks where the authentication came from, and denies the session even when the credentials presented are valid [9]. That second one is the more useful primitive: it blocks a replayed credential from outside the perimeter at the point of authentication, before any session is created [9]. AWS frames both as the controls you already run on API traffic, pointed at the interactive session [11].
The same path works from WorkSpaces, EC2 instances, and on-premises networks connected over Direct Connect or Site-to-Site VPN, according to the post [8]. If your operators sit on corporate desktops rather than inside the VPC, that is the sentence that decides whether any of this reaches you, and it is the one I would test first. Name resolution on the client is what determines whether traffic enters an endpoint at all, and that is a property of your DNS design, not of the launch.
One publisher here, and it is the vendor's own security blog [1]. The claim I would not carry into an audit response without checking is coverage. "The console requires internet access" stops being a property of the console and becomes a property of each console [4], which means the exception register probably gets longer and more specific before it gets shorter.
