HOW TO USE THE NEW CLOUDTRAIL NETWORK ACTIVITY EVENTS FOR VPC ENDPOINTS

Summary from the TLDR InfoSec newsletter

AWS recently launched a new class of CloudTrail logs that track network activity events for VPC endpoints. These logs can be used to assess the impact of proposed VPC endpoint policies in organizations that don't currently use endpoint policies and to detect data exfiltration. Any organization that uses VPC endpoints should enable network activity events for VpceAccessDenied errors and evaluate further events based on cost and utility.