Secrets Manager access should use a VPC endpoint, not public internet

What it checks

No VPC endpoint for Secrets Manager found in this workspace.

Where it applies

Terraform: aws_vpc_endpoint

CloudFormation: AWS::EC2::VPCEndpoint

How to fix it

1. Create a VPC Interface endpoint for com.amazonaws.<region>.secretsmanager with private_dns_enabled = true. Existing SDK calls automatically route to the endpoint.

Frameworks

• SOC 2 CC6.6
• HIPAA 164.312(e)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules