I Tried Accessing the Console Without an Internet Connection Using AWS Management Console Private Access
This page has been translated by machine translation. View original
Introduction
On June 15, 2026, AWS Management Console Private Access began supporting operation without an internet connection.
Conventionally, Console Private Access was mainly used to restrict accounts via the console / signin VPC endpoints, but an internet connection was required to retrieve the static assets (JS / CSS / images) needed to render the console UI. With the addition of the console-static endpoint, it is now possible to use the entire console access, including UI rendering, without going through the internet.
In this article, I placed a Windows EC2 instance in a VPC with no internet access, operated the browser via Fleet Manager Remote Desktop, and verified signing in to the console, displaying some service screens, and API communication.
Test Environment and Configuration
- Region: ap-northeast-1 (Tokyo)
- VPC: 10.0.0.0/16, DNS support / DNS hostnames enabled
- Subnet: private only (10.0.1.0/24), no IGW / NAT
- EC2: Windows Server 2022, t3.medium, no public IP
- Connection method: SSM Fleet Manager (Remote Desktop)
- Sign-in method: IAM user
"No internet connection" applies to the communication path from the EC2 instance in the VPC to the console / AWS APIs. The path on the side of the management terminal that opens Fleet Manager is out of scope.
VPC Endpoints
For the Management Console (Interface type, PrivateDNS enabled)
| Service name | Purpose |
|---|---|
| com.amazonaws.ap-northeast-1.console | Management Console |
| com.amazonaws.ap-northeast-1.signin | Sign-in |
| com.amazonaws.ap-northeast-1.console-static | Static content delivery (newly added) |
For SSM connection (Interface type, PrivateDNS enabled)
| Service name | Purpose |
|---|---|
| com.amazonaws.ap-northeast-1.ssm | SSM service |
| com.amazonaws.ap-northeast-1.ssmmessages | SSM session communication |
| com.amazonaws.ap-northeast-1.ec2messages | EC2 messages |
For service APIs (Gateway type)
| Service name | Purpose |
|---|---|
| com.amazonaws.ap-northeast-1.s3 | S3 API (for verifying the bucket list screen display) |
| com.amazonaws.ap-northeast-1.dynamodb | DynamoDB API (for verifying the console screen display) |
The security group allows inbound 443/TCP from the VPC CIDR for the endpoints.
CloudFormation Template
CloudFormation Template (console-private-access.yaml)
AWSTemplateFormatVersion: "2010-09-09"
Description: Console Private Access - Internet-free VPC with Management Console access via PrivateLink
Parameters:
LatestWindowsAmi:
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
Default: /aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base
Resources:
# VPC
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
EnableDnsSupport: true
EnableDnsHostnames: true
Tags:
- Key: Name
Value: console-private-access-vpc
# Private Subnet
PrivateSubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: 10.0.1.0/24
AvailabilityZone: !Select [0, !GetAZs ""]
MapPublicIpOnLaunch: false
Tags:
- Key: Name
Value: console-private-access-private-subnet
# Route Table (no routes to internet)
PrivateRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: console-private-access-rt
PrivateSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PrivateSubnet
RouteTableId: !Ref PrivateRouteTable
# Security Group for VPC Endpoints
EndpointSG:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Allow HTTPS from VPC
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 443
ToPort: 443
CidrIp: 10.0.0.0/16
Tags:
- Key: Name
Value: console-private-access-endpoint-sg
# Security Group for EC2
EC2SG:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: EC2 instance SG
VpcId: !Ref VPC
Tags:
- Key: Name
Value: console-private-access-ec2-sg
# VPC Endpoints - Console
ConsoleEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.console
VpcEndpointType: Interface
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref EndpointSG
PrivateDnsEnabled: true
SigninEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.signin
VpcEndpointType: Interface
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref EndpointSG
PrivateDnsEnabled: true
ConsoleStaticEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.console-static
VpcEndpointType: Interface
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref EndpointSG
PrivateDnsEnabled: true
# VPC Endpoints - SSM
SsmEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.ssm
VpcEndpointType: Interface
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref EndpointSG
PrivateDnsEnabled: true
SsmMessagesEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.ssmmessages
VpcEndpointType: Interface
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref EndpointSG
PrivateDnsEnabled: true
Ec2MessagesEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.ec2messages
VpcEndpointType: Interface
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref EndpointSG
PrivateDnsEnabled: true
# VPC Endpoints - Gateway
S3Endpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
VpcEndpointType: Gateway
RouteTableIds:
- !Ref PrivateRouteTable
DynamoDBEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref VPC
ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb
VpcEndpointType: Gateway
RouteTableIds:
- !Ref PrivateRouteTable
# IAM Role for EC2 (SSM)
EC2Role:
Type: AWS::IAM::Role
Properties:
RoleName: console-private-access-ec2-role
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: ec2.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
EC2InstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Roles:
- !Ref EC2Role
# EC2 Instance
WindowsInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: !Ref LatestWindowsAmi
InstanceType: t3.medium
SubnetId: !Ref PrivateSubnet
SecurityGroupIds:
- !Ref EC2SG
IamInstanceProfile: !Ref EC2InstanceProfile
Tags:
- Key: Name
Value: console-private-access-windows
Outputs:
InstanceId:
Value: !Ref WindowsInstance
Description: EC2 Instance ID (use SSM Fleet Manager to RDP)
VpcId:
Value: !Ref VPC
Trying It Out
Sign-in
After deploying the CloudFormation stack, I confirmed that the EC2 instance had been registered as an SSM managed instance and connected via RDP using Fleet Manager's Remote Desktop. I accessed https://console.aws.amazon.com in the Edge browser inside the EC2 instance.
When I entered the IAM user's credentials and signed in, Console Home was displayed. A Private Access banner is shown at the top of the screen.
Checking the Consoles of Supported Services
I checked the S3 and DynamoDB console screens. Because this configuration has Gateway Endpoints for S3 / DynamoDB, I was able to display the S3 bucket list screen and the DynamoDB console screen.
S3
DynamoDB
Behavior When the Service API Endpoint Is Not Added
When I opened the EC2 console screen, the screen itself was displayed, but because I had not added the EC2 service's API endpoint, retrieving resource information failed and API Errors occurred frequently.
The console UI display (via the console / signin / console-static endpoints) and service API connectivity are separate layers. Even if the console screen can be displayed, data retrieval may fail if the service API endpoints required by that screen or operation are not present.
Notes
- The supported services are listed in the official documentation (about 45 services as of June 16, 2026). Service consoles not on the list are not supported via Private Access. To use them, a separate path such as an internet route is required
- AWS CloudShell and the Default Region setting cannot be used via Private Access
- Depending on the console operations, additional service API endpoints may be required
- This verification used a minimal configuration, prioritizing reproducibility. For production use, control the access scope with IAM policies and the endpoint policies of the corresponding VPC Endpoints
- Gateway Endpoints are for resources inside the VPC only. If you use them from on-premises via Direct Connect, separate design is required
Summary
When Console Private Access was released in 2023, an internet connection was required to retrieve static assets.
With the addition of the console-static endpoint, this restriction has been removed. In this verification, from a Windows EC2 instance placed in a VPC without an IGW / NAT, by combining the Interface Endpoints for console display (console / signin / console-static) with the VPC Endpoints for the necessary service APIs, I confirmed sign-in to the AWS Management Console, the S3 bucket list screen, and the DynamoDB console screen.
For supported service consoles, console access can now be configured via VPC Endpoints, which broadens the options for network control. On the other hand, in a configuration that eliminates internet routes, there are more considerations such as availability design and cost for private connectivity, so I recommend evaluating these as well when adopting it.
References
