> My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.

It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services."

Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...