KMS access should use a VPC endpoint, not public internet

What it checks

No VPC endpoint for KMS found in this workspace.

Where it applies

Terraform: aws_vpc_endpoint

CloudFormation: AWS::EC2::VPCEndpoint

How to fix it

1. Create a VPC Interface endpoint for KMS. Existing KMS SDK calls automatically route through the endpoint once private DNS is enabled.

Frameworks

• SOC 2 CC6.6
• HIPAA 164.312(e)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules