title: AWS private subnet security group egress whitelist for AWS services?
body: <p>I have some EC2 instances in a private subnet that need to access DynamoDB and KMS. Since VPC endpoints do not support either of these at this time, I will need to grant internet access via a NAT gateway. </p>
  
  <p>I want to restrict the security group egress rules to only these 2 services, but the only info I have found to date is @ <a href="http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html" rel="nofollow">http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html</a> </p>
  
  <p>Has anyone else been able to restrict the security group egress rules to just include AWS services ?</p>
  
  <p>From what I can see the EC2 service entries are a subset of the AMAZON service entries so I'm guessing if I were to include all the CIDR blocks that do not exist in the EC2 list that would leave me with all the other AWS service IPs ?</p>
  
  <p>I know these are dynamic and would therefore need to subscribe and handle updates.</p>
  
  <p>Thanks in advance</p>
  
  <p>Pat</p>