How to use the new CloudTrail network activity events for AWS VPC Endpoints

The report describes AWS CloudTrail network activity events for VPC Endpoints, detailing how they capture management and data-plane calls to improve visibility, tune VPC Endpoint policies, and detect potential data exfiltration (e.g., via VpceAccessDenied). It advises minimally enabling denied-event logging per service, weighing costs versus Data Events, and notes example event patterns and limitations when external principals are denied—positioning the logs as an important control for AWS data perimeter strategies.