How can I implement AWS QLDB standard mode with VPC endpoint?

Question

AWS recommends QLDB Standard permissions mode instead of Allow_all in order to allow least privilege access for resources which need to run operations on QLDB.

Reference: https://docs.aws.amazon.com/qldb/latest/developerguide/getting-started-standard-mode.html

However, If you are using VPC endpoints to have a private channel between these resources and QLDB, according to the following documentation only the SendCommand action is allowed supported by VPC endpoint: "This policy example specifies only the SendCommand action because it's the only QLDB action that currently supports interface endpoints."

Reference: https://docs.aws.amazon.com/qldb/latest/developerguide/vpc-endpoints.html

That being said, it looks like is not possible to implement QLDB standard mode through VPC endpoint.

Is that assumption right or is it possible to have QLDB standard mode + VPC endpoint?

Answer 1

I've updated a little POC to show QLDB in standard mode working with a VPC endpoint. You can find the repo here - https://github.com/AWS-South-Wales-User-Group/qldb-vpc

Answer 2

Thanks for your feedback on the doc. QLDB standard mode + VPC endpoint is supported. You are able to restrict permissions to run PartiQL commands on QLDB resources with IAM actions in standard mode, e.g. qldb:PartiQLCreateTable.