AWS Management Console Private Access now GA for internet-restricted VPCs

AWS Management Console Private Access is now generally available, enabling organizations in regulated industries to route all supported service console traffic, including authentication flows and static assets, through AWS PrivateLink VPC endpoints. This eliminates the need for internet gateways, NAT gateways, or any public internet routes for console access within isolated network environments.

Private Access now enables restricting which AWS accounts and organizational identities can use the AWS Management Console from within your VPC, preventing access from personal or outside accounts. By combining VPC endpoint policies with `aws:ResourceOrgID` conditions and sign-in resource control policies (RCPs), console actions are automatically scoped to resources inside your organization.

This launch ensures that all traffic for supported service consoles flows entirely through your VPC endpoints, removing the need to maintain proxy allowlists or operate TLS-intercepting proxies. It allows seamless console access from Amazon WorkSpaces, Amazon EC2 instances, and on-premises networks connected via AWS Direct Connect or AWS Site-to-Site VPN, ensuring the same network controls are applied.

AWS Management Console Private Access and sign-in resource control policies naturally extend existing service control policies (SCPs), resource control policies, and VPC endpoint policies to interactive browser sessions. This ensures that identity, resource, and network data perimeter controls that protect programmatic access now also protect console-based interactions.