AWS HA IP-Secondary Not Working

[S.Green424422]

Hi

I am having issues with 2 Palo Alto's setup as an HA Pair using IP-Secondary failover, where the Secondary IP Address does not move between the two devices.

I have found the following article which shows the error I am getting in the logs:-

PA-VM deployed in AWS does not move ENI’s to newly active unit ... - Knowledge Base - Palo Alto Netw...

My Management Interfaces do not have Public IP Addresses for security reasons and so I am looking at resolution option 3:-

"Alternatively, VPC endpoints can be used to reach AWS service points if elastic IP assignment is not permitted."

However there is no information provided as to how to set this up. I can create a VPC Endpoint but there are lots of services that I could select.

Anyone know how to resolve this?

Thanks in advance.

Steve