VPC endpoint policies for syslog

You can attach a VPC endpoint policy to your syslog VPC endpoint to control what traffic is allowed through it. This provides an additional layer of access control beyond security groups and resource policies.

By default, a VPC endpoint has a full-access policy that allows all traffic. You can restrict this by attaching a custom policy. For more information about VPC endpoint policies, see Control access using endpoint policies in the AWS PrivateLink Guide.

Important

Syslog traffic arrives as an anonymous principal (no IAM identity on the wire). Policies must use "Principal": "*" and scope access using action, resource, or VPC condition keys. Principal-scoped policies (for example, policies that allow only a specific IAM role) will deny all syslog traffic.

Supported condition keys

The following condition keys are supported in VPC endpoint policies for syslog:

Condition key	Description	Example value
aws:SourceVpc	The VPC from which the traffic originates.	vpc-111bbb22
aws:SourceVpce	The VPC endpoint through which the traffic arrives.	vpce-0abc123def456
aws:VpcSourceIp	The private IP address of the sender within the VPC.	10.0.1.50
aws:ResourceAccount	The account that owns the target log group.	123456789012
aws:ResourceOrgID	The organization ID of the account that owns the target log group.	o-aa111bb222
aws:ResourceOrgPaths	The organizational unit path of the account that owns the target log group.	o-aa111bb222/r-ab12/ou-ab12-11111111/*

The following condition keys are not supported because syslog traffic has no IAM principal identity:

• aws:PrincipalArn

• aws:PrincipalAccount

• aws:PrincipalOrgID

• aws:PrincipalOrgPaths

• aws:PrincipalTag/*

Policies that use unsupported condition keys will result in an implicit deny, blocking all syslog traffic through the endpoint.

Restrict to a specific log group

The following policy allows syslog traffic only to a specific log group:

aws ec2 modify-vpc-endpoint \
  --vpc-endpoint-id $VPCE_ID \
  --policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "logs:PutLogEvents",
      "Resource": "arn:aws:logs:Region:account-id:log-group:/syslog/my-devices"
    }
  ]
}' \
  --region $REGION

Deny all traffic

The following policy blocks all syslog traffic through the endpoint. This is useful for temporarily stopping ingestion without deleting the endpoint:

aws ec2 modify-vpc-endpoint \
  --vpc-endpoint-id $VPCE_ID \
  --policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "*",
      "Resource": "*"
    }
  ]
}' \
  --region $REGION

Reset to default policy

To restore the default allow-all policy:

aws ec2 modify-vpc-endpoint \
  --vpc-endpoint-id $VPCE_ID \
  --reset-policy \
  --region $REGION

Policy propagation

After you create or modify a VPC endpoint policy, it can take up to several minutes for the policy change to take effect. During this propagation period, the previous policy (or default policy) continues to apply.

If a VPC endpoint policy denies syslog traffic, you will see the following indicators:

• TCP connections are closed immediately after the policy evaluation.

• UDP datagrams are dropped.

• The SyslogMessagesDropped metric with Reason=VpcePolicyDenied is emitted.

• The SyslogConnectionsRejected metric with Reason=VpcePolicyDenied is emitted for TCP connections.