Six findings from the endpoint review, and the three that are real
A VPC was moved off its NAT gateway and onto interface endpoints. The bill dropped, the traffic is private, and everything works — which is the point at which a design review is worth doing and nobody wants one.
Six findings came out of that review. Three describe something that will hurt. Three describe normal, documented behaviour that somebody found alarming.
Boundaries, outermost first: The review findings: Private DNS is off (on the endpoint), Endpoint in one AZ (two zones have none), Endpoint names are public (anyone resolves them), DNS hostnames off (on the VPC itself), App uses the public name (not the vpce name), Calls alternate zones (not pinned to one) The reviewed VPC: Interface endpoint (one subnet), The workload (three zones) This diagram draws no connections between its components.