Loading tool
Generate VPC endpoint policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Step 1
Set the AWS context used when adding generated DynamoDB resources to the endpoint policy.
Step 2
The action list is scoped to AWS Policy Generator's VPC Endpoint Policy actions.
Step 3
No VPC endpoint actions selected yet.
Search for a VPC endpoint action above to start generating an endpoint policy.
This generator uses AWS Policy Generator's VPC Endpoint Policy action set and enriches it with Service Authorization Reference metadata for Amazon S3 and Amazon DynamoDB so you can build endpoint policies with actions, principals, resources, and condition keys in one place.
VPC endpoint policies include a Principal element because the policy is attached to the endpoint and controls who can use that private path to reach the target service. The resource scope still points at the service resource, such as an S3 bucket/object ARN or a DynamoDB table ARN.
Need a different policy type? Switch to the IAM policy generator, S3 bucket policy generator, SNS topic policy generator, or SQS queue policy generator.
It follows AWS Policy Generator's VPC Endpoint Policy scope, which currently exposes Amazon S3 actions and a DynamoDB VPC policy action subset. The generated dataset cross-checks those actions against AWS Service Authorization Reference data.
Use IAM identity policies to grant permissions to identities. Use a VPC endpoint policy to add a network boundary on the endpoint path so requests through that endpoint are limited to specific principals, actions, resources, and conditions.
Endpoint policies are resource policies. The Principal element identifies who can use the endpoint policy statement, such as an AWS account, IAM role ARN, service principal, federated principal, or wildcard.
No. The policy is attached to the VPC endpoint, but the Resource element targets service resources, for example arn:aws:s3:::example-bucket/* or a DynamoDB table ARN.
The generator includes AWS global condition keys from AWS Policy Generator plus service condition keys from the enriched S3 and DynamoDB action metadata, including keys such as aws:SourceVpce, aws:SecureTransport, s3:prefix, and DynamoDB action-specific keys.
Yes. The JSON output is a standard endpoint policy document, the Terraform output includes an aws_iam_policy_document data source with aws_vpc_endpoint_policy, and the CloudFormation output includes an AWS::EC2::VPCEndpoint snippet with a PolicyDocument.
Related tools
Generate SQS queue policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Generate S3 bucket policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Generate SNS topic policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Next step
I build these tools to make AWS easier to manage. If this level of quality is what you want in your own cloud platform, Towards The Cloud can help with landing zones, infrastructure as code, security reviews, migrations, and cost optimization.