AWS Console Private Access can block sign-ins to personal accounts

AWS Console Private Access enables the Management Console (static assets, console-only APIs, and service API calls) to operate entirely over PrivateLink endpoints inside VPCs with no public internet. Operators must create three interface endpoints per Region (console, sign-in, console-only APIs), configure private DNS and security groups, and can verify success via the console lock icon and CloudTrail ConsoleLogin events with vpcEndpointId. Endpoint policies (using aws:PrincipalOrgID and aws:ResourceOrgID) and sign-in resource control policies can restrict who can sign in from a network; limitations include no VPC endpoint yet for IAM Identity Center, only a subset of service consoles supported, potential service panels failing if endpoints are missing, billing for each endpoint, and risk of locking out the organization if policies are misconfigured.