Currently, the AwsPrivateEndpointConfigurationProperties object allows the consumer to specify a VpcId and SubnetIds, but it does not allow us to specify a custom Security Group into which the AWS-side VPC Private Endpoint should be added.

The ServerlessPrivateEndpoint custom resource also does not create a security group for the endpoint, instead just dumping it into the default security group for the VPC. I can see no way to customize this behavior.