AWS Endpoints Region Drift Monitor

Monitor public AWS SDK endpoint metadata for service-region coverage, hostnames, FIPS/dual-stack variants, and deprecated endpoint drift.

This Actor is for platform, cloud governance, compliance, and developer-tool teams that need a scheduled machine-readable signal when the public AWS endpoint map changes. It is not affiliated with Amazon Web Services and it does not call your AWS account or require AWS credentials.

What it checks

The Actor fetches the public botocore endpoints.json metadata used by AWS SDK tooling and turns selected AWS service endpoint records into deterministic dataset rows.

For each selected service/endpoint key it reports:

• AWS partition (aws, aws-us-gov, aws-cn, etc.)
• service identifier (s3, sts, lambda, ec2, ...)
• endpoint key / region
• rendered endpoint hostname
• FIPS and dual-stack variant availability
• protocols and signature versions
• deprecated endpoint flags
• canonical endpoint fingerprint for baseline comparison

Repeat-use loop

Run this Actor on a schedule and pass the previous run dataset as baselineDataset. New service-region endpoints, changed hostnames, FIPS/dual-stack variant changes, or deprecated endpoint rows become alerts. This is useful before regional expansion, compliance reviews, SDK endpoint changes, and cloud governance checks.

Input

Typical private smoke input:

{
  "partitions": ["aws"],
  "services": ["s3", "sts", "lambda", "ec2", "iam", "kms"],
  "endpointKeyPatterns": ["us-*", "eu-*", "aws-global"],
  "criticalServices": ["s3", "sts", "iam", "lambda", "kms"],
  "includeDeprecatedEndpoints": false,
  "includeUnchangedRows": true,
  "maxRows": 100
}

For drift detection, select a previous dataset with the resource picker. Under Apify limited permissions, the picker is preferred over typing private dataset IDs manually.

Output

Each dataset row is one selected AWS endpoint record. OUTPUT contains a run summary, source metadata hash, alert counts, and a compact snapshot for chained baselines.

Important fields:

• alert / priority / alertReasons
• changedSincePrevious / newSincePrevious
• endpointHostname
• fipsAvailable / dualstackAvailable
• deprecated
• endpointHash

Pricing

This Actor uses Apify Pay Per Event (PPE) pricing:

• apify-actor-start: $0.00005 per run start.
• apify-default-dataset-item: $0.002 per dataset row (Monitor row).
• Platform usage is included in the event price; users do not pay a separate platform-usage pass-through.
• A dataset row is one monitored result, source, or drift-check row emitted by the Actor. Run cost scales with the number of rows produced and the limits you choose.

Use Apify's max total charge setting before starting a run if you want a hard spend cap.

Limitations

• Source data is public AWS SDK endpoint metadata from the botocore repository, not a contractual AWS SLA or an AWS account inventory.
• Use official AWS documentation and AWS support for final operational decisions.
• This Actor does not test live network reachability of every endpoint; it monitors metadata drift.
• No private AWS credentials or confidential infrastructure data should be submitted.

Responsible use

Use this Actor for monitoring public endpoint metadata and internal change review. Do not represent its output as an official AWS certification, compliance opinion, or legal advice.