This guide documents the new AWS Wickr administration console, released on March 13, 2025. For documentation on the classic version of the AWS Wickr administration console, see Classic Administration Guide.

VPC endpoint policies for AWS Wickr

A VPC endpoint policy is an IAM resource policy that you attach to a VPC endpoint to control which resources and actions are accessible through that endpoint. You can attach VPC endpoint policies to Wickr Messaging and Wickr Admin endpoints.

For Wickr Messaging endpoints, VPC endpoint policies enable you to enforce data perimeter controls. For example, you can restrict which Wickr networks are reachable through a VPC endpoint so that users can't connect to unauthorized networks. For Wickr Admin endpoints, VPC endpoint policies support the same network and condition controls as Messaging, and additionally allow you to control which specific administrative actions are permitted through the endpoint.

For more information about VPC endpoints, see Control access to services using endpoint policies in the AWS PrivateLink Guide.

Considerations

VPC endpoint policies for Wickr Messaging

For Wickr Messaging endpoints, VPC endpoint policies enable you to enforce data perimeter controls. For example, you can attach a VPC endpoint policy that permits access only to your organization's Wickr networks.

Policy elements for Wickr Messaging

The following elements are supported in VPC endpoint policies for Wickr Messaging:

Example VPC endpoint policies for Wickr Messaging

The following are example VPC endpoint policies for Wickr Messaging.

Restrict access to a specific Wickr network

The following VPC endpoint policy allows access only to the Wickr network with the specified network ID. All traffic to other Wickr networks through this endpoint is denied.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": "wickr:*",
            "Resource": "arn:aws:wickr:us-east-1:123456789012:network/12345678"
        }
    ]
}

Restrict access to a specific VPC

The following VPC endpoint policy allows access to a Wickr network only if the request originates from the specified VPC. This is useful when you have multiple VPC endpoints configured and you want to restrict which VPCs can reach your Wickr network.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": "wickr:*",
            "Resource": "arn:aws:wickr:us-east-1:123456789012:network/12345678",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpc": "vpc-1a2b3c4d"
                }
            }
        }
    ]
}

Restrict access to a specific VPC endpoint

The following VPC endpoint policy allows access to a Wickr network only through the specified VPC endpoint. This is useful when you have multiple VPC endpoints and you want to limit which endpoint can be used to reach a specific Wickr network.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": "wickr:*",
            "Resource": "arn:aws:wickr:us-east-1:123456789012:network/12345678",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpce": "vpce-0abcdef1234567890"
                }
            }
        }
    ]
}

Deny access to all Wickr networks except a specific network

The following VPC endpoint policy denies access to all Wickr networks except the specified network. This is useful when you want to ensure that only your organization's Wickr network is accessible through the VPC endpoint, and all other networks are blocked. Unlike the allow-only policy, this explicit deny can't be overridden by other policy statements.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Deny",
            "Action": "wickr:*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:SourceVpce": "vpce-0abcdef1234567890"
                }
            }
        },
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": "wickr:*",
            "Resource": "arn:aws:wickr:us-east-1:123456789012:network/12345678"
        }
    ]
}

The first statement denies all Wickr actions when the request doesn't come from the specified VPC endpoint. The second statement allows access to the specified Wickr network. Together, these statements ensure that only the specified network is accessible, and only through the specified VPC endpoint.

Restrict access with multiple conditions

The following VPC endpoint policy allows access to a Wickr network only when all specified conditions are met: the request must originate from a specific VPC, through a specific VPC endpoint, and from a VPC endpoint owned by a specific AWS account.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": "wickr:*",
            "Resource": "arn:aws:wickr:us-east-1:123456789012:network/12345678",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpc": "vpc-1a2b3c4d",
                    "aws:SourceVpce": "vpce-0abcdef1234567890",
                    "aws:VpceAccount": "123456789012"
                }
            }
        }
    ]
}

VPC endpoint policies for Wickr Admin

For Wickr Admin endpoints, VPC endpoint policies support all the same policy elements as Wickr Messaging, including network resource restrictions and condition keys (aws:SourceVpc, aws:SourceVpce, aws:VpceAccount). In addition, Wickr Admin supports specific action-level controls. You can use the wildcard action wickr:* to allow or deny all actions, or specify individual Wickr Admin actions. For a complete list of Wickr actions, see Actions defined by AWS Wickr in the Service Authorization Reference.

Example VPC endpoint policies for Wickr Admin

Restrict access to a specific Wickr network

The following VPC endpoint policy allows all Wickr Admin actions, but only for the specified network resource.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": "wickr:*",
            "Resource": "arn:aws:wickr:us-east-1:123456789012:network/12345678"
        }
    ]
}

Allow only read-only access to a specific Wickr network

The following VPC endpoint policy allows only read-only Wickr Admin actions on a specific network through the endpoint. Write operations such as creating or deleting networks are not permitted.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": [
                "wickr:ListNetworks",
                "wickr:GetNetwork",
                "wickr:GetNetworkSettings",
                "wickr:ListUsers",
                "wickr:GetUser",
                "wickr:GetUsersCount"
            ],
            "Resource": "arn:aws:wickr:us-east-1:123456789012:network/12345678"
        }
    ]
}

Default VPC endpoint policy

If you don't attach a custom policy to a VPC endpoint, the default endpoint policy is applied. The default policy allows full access to Wickr through the endpoint.

{
    "Statement": [
        {
            "Principal": "*",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

To restrict access, attach a custom endpoint policy to the VPC endpoint.

Create a VPC endpoint policy for Wickr

You can create and attach a VPC endpoint policy when you create a VPC endpoint, or you can attach a policy to an existing VPC endpoint.

Attach a VPC endpoint policy using the AWS Management Console

Attach a VPC endpoint policy using the AWS CLI

Use the modify-vpc-endpoint command to attach a policy to an existing VPC endpoint.

aws ec2 modify-vpc-endpoint \
    --vpc-endpoint-id vpce-0abcdef1234567890 \
    --policy-document file://policy.json

Replace vpce-0abcdef1234567890 with the ID of your Wickr VPC endpoint, and policy.json with the path to your endpoint policy JSON file.