Extend your data perimeter to the AWS Management Console with Private Access

Organizations in regulated industries such as financial services, government, defense, and healthcare restrict their sensitive workloads to isolated network environments with no access to the public internet. Until now, customers could restrict AWS Management Console access to authorized AWS accounts and corporate networks, but the console itself required internet connectivity. This was creating tension between operational convenience and network security controls.

We’re happy to announce that AWS Management Console <a href="https://aws.amazon.com/about-aws/whats-new/2026/06/aws-management-console-private/" target="_blank" rel="noopener noreferrer">Private Access</a> is now generally available with support for virtual private clouds (VPCs) without internet connectivity. Organizations in regulated industries that restrict workloads to isolated network environments can now route all traffic for supported service consoles—including authentication flows, static assets (JavaScript, CSS, images), console-only APIs, and AWS service API calls—through <a href="https://aws.amazon.com/privatelink/" target="_blank" rel="noopener noreferrer">AWS PrivateLink</a> VPC endpoints, eliminating the need for an internet gateway, NAT gateway, or any route to the public internet. This capability is available in all <a href="https://docs.aws.amazon.com/glossary/latest/reference/glos-chap.html?icmpid=docs_homepage_addtlrcs#region" target="_blank" rel="noopener noreferrer">AWS commercial Regions</a> for a select set of <a href="https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/supported-regions-consoles.html" target="_blank" rel="noopener noreferrer">supported service consoles</a>.

In 2023, we launched AWS Management Console Private Access, which you can use to connect to the console by routing console, sign-in, and service API calls through VPC endpoints. However, accessing the console required internet connectivity for static assets and console-only APIs. This meant security teams faced a choice: allow internet connectivity to use the console or deny console access to operators working in network-isolated environments.

With this launch, AWS Management Console Private Access addresses two common scenarios:

<ul>

<li>Console traffic over internet restricted networks: Traffic for supported service consoles now flows entirely through your VPC endpoints—no proxy allowlists to maintain, no TLS-intercepting proxies to operate, and no CLI-only workflows to accept as a compromise. The same path works seamlessly from <a href="https://aws.amazon.com/workspaces/" target="_blank" rel="noopener noreferrer">Amazon WorkSpaces</a>, <a href="https://aws.amazon.com/ec2" target="_blank" rel="noopener noreferrer">Amazon Elastic Compute Cloud (Amazon EC2)</a> instances, and on-premises networks connected through <a href="https://aws.amazon.com/direct-connect" target="_blank" rel="noopener noreferrer">AWS Direct Connect</a> or <a href="https://aws.amazon.com/vpn/site-to-site-vpn/" target="_blank" rel="noopener noreferrer">AWS Site-to-Site VPN</a>. Combined with sign-in resource control policies (RCPs) and sign-in resource policies, you can ensure that console authentication only succeeds from expected networks—even if valid credentials are presented elsewhere, the session is denied. Teams that previously relied on restricted egress rules or manual domain allowlists now get full console access with the same network controls they already trust.</li>

<li>Data-exfiltration prevention: Private Access enables you to restrict which AWS accounts and organizational identities can use the AWS Management Console from within your VPC. This prevents access from personal accounts and from accounts outside your organization. Attach a VPC endpoint policy with an <code style="color: #000000">aws:ResourceOrgID</code> condition, and console actions are automatically scoped to resources inside your organization. Sign-in RCPs add a second layer by ensuring authentication only succeeds from networks within your perimeter. Together, these controls prevent supported service consoles from being used to access resources in accounts outside your organization—such as personal accounts—without requiring complex network-layer workarounds.</li>

</ul>

In this post, you will learn how AWS Management Console Private Access works in environments without internet connectivity, and how to layer access controls using VPC endpoint policies and sign-in resource control policies (RCPs) to strengthen your data perimeter.

<h2>Solu