> If you're not using VPC endpoints, basically you're routing all your AWS traffic to the open internet.
yes this is what i normally hear. but by “the open internet” you mean “some other spot in the AWS data center”. what’s the risk here? somebody is going to slip some bad routes into AWS over BGP? and then also fake the SSL certs? this seems like some mission impossible stuff.
> Honestly there is just no argument for _not_ using VPC endpoints.
unless something has changed in the last three months they’re not available for all services. would you advocate against using those services?
> If you are still unconvinced, the pricing argument of course still stands.
sure that and the exfiltration argument are reasonable enough.
yes this is what i normally hear. but by “the open internet” you mean “some other spot in the AWS data center”. what’s the risk here? somebody is going to slip some bad routes into AWS over BGP? and then also fake the SSL certs? this seems like some mission impossible stuff.
> Honestly there is just no argument for _not_ using VPC endpoints.
unless something has changed in the last three months they’re not available for all services. would you advocate against using those services?
> If you are still unconvinced, the pricing argument of course still stands.
sure that and the exfiltration argument are reasonable enough.
thanks for response