AWS add vpc-endpoint filter for vpc

[anovis]

Adds vpc-endpoint filter for a vpc.

for example

            policies:
              - name: s3-vpc-endpoint-enabled
                resource: vpc
                filters:
                  - type: vpc-endpoint
                    key: ServiceName
                    value: com.amazonaws.us-east-1.s3

closes #5933

[JohnHillegass]

lgtm!

[PratMis]

Looks like we can choose the subnets in a vpc to associate the vpc-endpoint to. For ex - If we have two subnets in a vpc, we can choose to grant one subnet access to the endpoint while blocking the other.
Feel like this filter should be at the subnet level than having it at the vpc level, since a vpc can have multiple subnets.

[JohnHillegass]

Looks like we can choose the subnets in a vpc to associate the vpc-endpoint to. For ex - If we have two subnets in a vpc, we can choose to grant one subnet access to the endpoint while blocking the other.
Feel like this filter should be at the subnet level than having it at the vpc level, since a vpc can have multiple subnets.

@PratMis Fair point! I had an impression the original intention was to simply check if a VPC endpoint is connected to a VPC. I guess it depends on the implementation need. @anovis do you need to also look at the subnet level? I guess there could be a subtle distinction between all vpcs must have a s3 vpc endpoint attached and all subnets in a vpc must have a s3 vpc endpoint attached

[anovis]

yeah makes sense. i can make the same filter for the subnet resource as well.

correctness issue

[kapilt]

get related ids is generally intended to be a lightweight implementation, it gets called frequently, ie once per resource, doing an api call / or cache lookup isn't ideal for an implementation.

[anovis]

yeah good call out. i had noticed that while writing the subnet tests.

Instead I modified the get_related and process_resource, but not sure if that is the best way.

[kapilt]

so rather than duplicating the implementation for vpc and subnet, it would be better to have a related base class that addresses on the commonality. its distinct from the extant related base since its filtering the related resource to determine the related ids instead of using the policy resource to determine the ids. that feels like it has some reuse potential.

[kapilt]

lgtm, thanks