A private application cannot call an interface VPC endpoint on port 443. The endpoint is available. Its security group does not allow the application's security group. What should change?
Select an answer to reveal the explanation.
Short Explanation
The endpoint is up, and its security group is a locked door that does not list your application. You allow the application's security group in on 443. A public address deletes the private path you built the endpoint for.
Full Explanation
An interface VPC endpoint uses its own security group on the endpoint network interfaces. The endpoint is already available, and that group does not allow the application's security group, so the call on 443 never reaches the service. Allowing the application security group to reach the endpoint security group on 443 opens only that path. Replacing the interface endpoint with a gateway endpoint does not help: a gateway endpoint is a different endpoint type and is not a substitute for this partner service's interface endpoint. Giving the private instances public IP addresses and deleting the endpoint abandons the private path the application was built to use. Opening the endpoint security group to all traffic from the internet on every port is wider than the application and is not required for a private client. Caveat: the application's own security group still has to allow the outbound connection on 443, or the new inbound rule on the endpoint never sees a packet. Operational check: from an instance in the application security group, connect to the endpoint on 443 and confirm the call succeeds after the rule is saved.