Restrict access to S3 VPC Endpoint

Restrict access to S3 VPC Endpoint

Launch CloudFormation Template

  1. Access AWS Management Console

    • Find VPC
    • Select VPC

VPC Endpoint

  1. In the VPC interface

    • Select Enpoints
    • Select Create endpoint

VPC Endpoint

  1. In the Create endpoint interface

    • Name tag, enter S3-Endpoint
    • Select AWS services

VPC Endpoint

  1. In services, we find S3

    • Select Type Gateway

VPC Endpoint

  1. Select VPC SID-vpc, do not select Route Table

VPC Endpoint

  1. Select Create endpoint

VPC Endpoint

  1. Successfully created VPC endpoint

    • Note down Endpoint ID for the next steps

VPC Endpoint

  1. Access to S3 bucket

    • Select sid-security-xxx bucket

VPC Endpoint

  1. In the bucket interface

    • Select Permissions
    • Select Edit Bucket Policy.

VPC Endpoint

  1. Copy the bucket policy into the Bucket Policy Editor
{
    "Statement": [
        {
            "Action": "s3:*",
            "Effect": "Deny",
            "Resource": "arn:aws:s3:::BUCKET_NAME/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": "VPC_ENDPOINT_ID"
                }
            },
            "Principal": "*"
        }
    ]
}

- Replace your **BUCKET NAME** and **VPC ENDPOINT ID**.

VPC Endpoint

  1. Return to SSH interface
aws s3api head-object --key app1/file1 --profile user1 --bucket ${bucket}

VPC Endpoint

  1. Return to VPC endpoint interface

    • Select S3 endpoint
    • Select Actions
    • Select Manage route tables

VPC Endpoint

  1. In the Manage route tables interface

    • Select SID-routes
    • Select Modify route tables

VPC Endpoint

  1. Successfully added route table

VPC Endpoint

  1. Return to SSH interface
aws s3api head-object --key app1/file1 --profile user1 --bucket ${bucket}

VPC Endpoint