AWS endpoints are similarly publicly accessible, protected by single access keys or session keys. That's the nature of the Internet. Your VPN endpoints are al

AWS endpoints are similarly publicly accessible, protected by single access keys or session keys. That's the nature of the Internet. Your VPN endpoints are also publicly accessible; anyone with credentials or a RCE in the VPN endpoint can get through. At some point you just trust the common shared public key libraries that protect public APIs and VPNs.