code: function buildVPCEndpoint(service, { routeTableIds = [], subnetIds = [] } = {}) {
    const endpoint = {
      Type: 'AWS::EC2::VPCEndpoint',
      Properties: {
        ServiceName: {
          'Fn::Join': [
            '.',
            [
              'com.amazonaws',
              {
                Ref: 'AWS::Region',
              },
              service,
            ],
          ],
        },
        VpcId: {
          Ref: 'VPC',
        },
      },
    };
  
    // @see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html
    if (service === 's3' || service === 'dynamodb') {
      endpoint.Properties.VpcEndpointType = 'Gateway';
      endpoint.Properties.RouteTableIds = routeTableIds;
      endpoint.Properties.PolicyDocument = {
        Statement: [
          {
            Effect: 'Allow',
            /*
            TODO 11/21: We should restrict the VPC Endpoint to only the Lambda
            IAM role, but this doesn't work.
  
            Principal: {
              AWS: {
                'Fn::GetAtt': [
                  'IamRoleLambdaExecution',
                  'Arn',
                ],
              },
            }, */
            Principal: '*',
            Resource: '*',
          },
        ],
      };
      if (service === 's3') {
        endpoint.Properties.PolicyDocument.Statement[0].Action = 's3:*';
      } else if (service === 'dynamodb') {
        endpoint.Properties.PolicyDocument.Statement[0].Action = 'dynamodb:*';
      }
    } else {
      endpoint.Properties.VpcEndpointType = 'Interface';
      endpoint.Properties.SubnetIds = subnetIds;
      endpoint.Properties.PrivateDnsEnabled = true;
      endpoint.Properties.SecurityGroupIds = [
        {
          Ref: 'LambdaEndpointSecurityGroup',
        },
      ];
    }
  
    const parts = service.split(/[-_.]/g);
    parts.push('VPCEndpoint');
    const cfName = parts.map(part => part.charAt(0).toUpperCase() + part.slice(1)).join('');
  
    return {
      [cfName]: endpoint,
    };
  }
docs: Build a VPCEndpoint
  
  @param {String} service
  @param {Object} params
  @return {Object}