Data Exfiltration Controls

Console Private Access pulls the AWS console's static assets off the public internet

General availability landed August 28 for VPCs with no internet path, and the same endpoints let you turn away valid credentials presented from the wrong network, which stops personal-account sign-ins from the corporate LAN.