Security Groups with VPC Endpoints

The security group attached to an Interface VPC Endpoint controls traffic to the endpoint ENIs from within your VPC, not traffic from the endpoint to the AWS service.

Inbound rules determine which resources in the VPC can connect to the endpoint. Outbound rules control traffic leaving the endpoint ENIs toward the service.

The AWS service itself does not initiate connections back into your VPC through the endpoint.

Documentation: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html

Inbound rules determine which resources in the VPC can connect to the endpoint. Outbound rules control traffic leaving the endpoint ENIs toward the VPC not the service.

No outbound rules are required for vpc endpoints