False positives in VPC endpoint policy checks

Issue search

• I have searched the existing issues and this bug has not been reported yet

Which component is affected?

Prowler CLI/SDK

Cloud Provider (if applicable)

AWS

Steps to Reproduce

1. Create or assess a VPC endpoint for an AWS service that does not support custom endpoint policies, such as Amazon SES SMTP or AWS Transfer Family endpoints (such as SFTP).
2. Run vpc_endpoint_connections_trust_boundaries in the endpoint's Region.
3. Review the finding for that endpoint.

Expected behavior

The check does not report a failure when the endpoint's AWS service does not support custom endpoint policies, because the policy cannot be remediated.

https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html#vpce-endpoint-policy-support

Endpoints whose services support custom policies continue to be evaluated normally.

Actual Result with Screenshots or Logs

The check reports a failure for an immutable default-looking endpoint policy, resulting in a false positive that cannot be remediated.

How did you install Prowler?

pip

Environment Resource

Local workstation running Prowler against a real AWS account

OS used

macOS

Prowler version

5.42.0

Python version

Python 3.14.7

Pip version

pip 26.2.1

Context

Confirmed examples include Amazon SES SMTP and an AWS Transfer endpoint.