Setting up VPC endpoints for Amazon CloudFormation - Amazon CloudFormation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Setting up VPC endpoints for Amazon CloudFormation

You can improve the security posture of your VPC by configuring Amazon CloudFormation to use an interface VPC endpoint. Interface endpoints are powered by PrivateLink, a technology that enables you to privately access CloudFormation APIs by using private IP addresses. PrivateLink restricts all network traffic between your VPC and CloudFormation to the Amazon network. Also, you don't need an Internet gateway, a NAT device, or a virtual private gateway.

You aren't required to configure PrivateLink, but it's recommended. For more information about PrivateLink and VPC endpoints, see Accessing Amazon services through PrivateLink.

Before you begin

Before you configure VPC endpoints for CloudFormation, be aware of the following considerations.

  • When using the VPC endpoint feature, grant access to CloudFormation-specific S3 buckets for resources in a VPC that must respond to a custom resource request or a wait condition.

    If you use CloudFormation to create resources in a VPC with a VPC endpoint, you might need to modify your IAM endpoint policy so that it permits access to certain S3 buckets.

    CloudFormation has S3 buckets in each Region to monitor responses to a custom resource request or a wait condition. If a template includes custom resources or wait conditions in a VPC, the VPC endpoint policy must allow users to send responses to the following buckets:

    • For custom resources, permit traffic to the cloudformation-custom-resource-response-region bucket. When using custom resources, region names don't contain dashes. For example, uswest2.

    • For wait conditions, permit traffic to the cloudformation-waitcondition-region bucket. When using wait conditions, region names do contain dashes. For example, us-west-2.

    If the endpoint policy blocks traffic to these buckets, CloudFormation won't receive responses and the stack operation fails. For example, if you have a resource in a VPC in the us-west-2 Region that must respond to a wait condition, the resource must be able to send a response to the cloudformation-waitcondition-us-west-2 bucket.

    For a list of Regions that CloudFormation supports, see the Regions and endpoints page in the Amazon Web Services General Reference.

  • VPC endpoints currently don't support cross-Region requests — ensure that you create your endpoint in the same Region in which you plan to issue your API calls to CloudFormation.

  • VPC endpoints only support Amazon-provided DNS through Route 53. If you want to use your own DNS, you can use conditional DNS forwarding. For more information, see DHCP options sets in the Amazon VPC User Guide.

  • The security group attached to the VPC endpoint must allow incoming connections on port 443 from the private subnet of the VPC.

Creating the VPC EndPoint for Amazon CloudFormation

To create the VPC endpoint for the CloudFormation service, use the Creating an interface endpoint procedure in the Amazon VPC User Guide to create the following endpoint:


region represents the region identifier for an Amazon Web Services Region supported by CloudFormation, such as us-east-2 for the US East (Ohio) Region.