VPC endpoint policy allows full access

What's the problem

The endpoint policy gives Principal "*" every action on every resource, with no condition on the caller (aws:PrincipalOrgID, aws:SourceVpc…) or the resource owner (aws:ResourceOrgID). This is the default policy: anyone with credentials inside the VPC can copy data to a bucket in another account. MEDIUM because an attacker needs a foothold in the VPC first

How 6WAF detects it

• Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS, Secrets Manager, ACM, detection services) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
• Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
• Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.