# Cis AWS Euc 5.2

> Ensure a VPC Endpoint is set for AppStream

- Skill: `cyberstrikeus/cis-aws-euc-5-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aws-euc-5-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aws-euc-5-2/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aws-euc-5-2

---


# Ensure a VPC Endpoint is set for AppStream (Manual)

## Profile Applicability

- Level 1

## Description

When you select Using a VPC endpoint, this allows users to only stream from this AppStream 2.0 stack when they have network access to the VPC.

## Rationale

Virtual Private Cloud (VPC) endpoints allow your users to stream from AppStream 2.0 through your VPC. You can create a VPC endpoint in the VPC of your choosing, then use the endpoint with AppStream 2.0 VPC to maintain the streaming traffic within the VPC.

## Impact

None - this is a security best practice.

## Audit Procedure

Perform the steps to review the interface endpoint set for AppStream 2.0.

### Using AWS Console

1. Log in to the AppStream 2.0 console at `https://console.aws.amazon.com/appstream2`
2. In the left pane, click **Stacks**, click the link for the stack you wish to view
3. Scroll to the **VPC Endpoints** section
4. Confirm the Streaming Endpoint listed is the endpoint through which to stream traffic

If there is no Streaming endpoint pointing to a specific VPC Endpoint and it is labeled as Internet refer to the remediation below.

### Using AWS CLI

Not applicable - must be audited via Console.

## Expected Result

AppStream stack has a VPC Endpoint configured for streaming traffic.

## Remediation

### Using AWS Console

Perform the following steps to create an interface endpoint:

1. Log in to the VPC console at `https://console.aws.amazon.com/vpc/`
2. In the left pane, click **Endpoints**, **Create Endpoint**
3. Click **Create Endpoint**
4. Configure the endpoint:
   - For Service category, ensure that **AWS services** is selected
   - For Service Name, choose `com.amazonaws.<AWS Region>.appstream.streaming`
   - For VPC, choose a VPC in which to create the interface endpoint
   - For Subnets, choose the subnet (Availability Zone) in which to create the endpoint network interfaces
   - Ensure that the **Enable Private DNS Name** check box is selected
   - For Security group, select the security group for AppStream
5. Click **Create endpoint**

**To update a stack to use a new interface endpoint:**

1. Log in to AppStream 2.0 console at `https://console.aws.amazon.com/appstream2`
2. In the left pane, click **Stacks**, and click the link of the stack name wish to edit
3. Scroll to the **VPC Endpoints**, and then choose **Edit**
4. In the Edit VPC Endpoint dialog box, for Streaming Endpoint, choose the endpoint you just created
5. Click **Save Changes**

Traffic for new streaming sessions will be routed through this endpoint. However, traffic for current streaming sessions continues to be routed through the previously specified endpoint.

### Using AWS CLI

Not applicable - must be configured via Console.

## Default Value

By default, VPC endpoints must be manually configured.

## References

1. https://docs.aws.amazon.com/appstream2/latest/developerguide/creating-streaming-from-interface-vpc-endpoints.html

## CIS Controls

**v8:**

- 3.12 Segment Data Processing and Storage Based on Sensitivity
  - Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.

**v7:**

- 14.1 Segment the Network Based on Sensitivity
  - Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).

## Profile

Level 1