AWS S3 VPC Endpoint

 

A VPC endpoint enables connections between a virtual private cloud (VPC) and supported services, without requiring that you use an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Therefore, your VPC is not exposed to the public internet.

Traffic from your VPC is sent to an endpoint service using a connection between the VPC endpoint and the endpoint service. Traffic between a VPC endpoint and an endpoint service stays within the AWS network, without traversing the public internet.

VPC endpoints are virtual devices. They are horizontally scaled, redundant, and highly available VPC components. 

Let's create an s3 VPC endpoint.

I launched an instance from VPC which has public and private IPs. So, when I do # aws s3 ls the call goes to the public endpoint. url=https://s3.us-east-1.amazonaws.com/

Now, we have the s3 VPCE created and it has a DNS name attached to it.

When using the DNS name to access a resource, replace * with the appropriate value. The appropriate values to use in place of * are as follows:

• bucket
• accesspoint
• control

For example, to access a bucket, use a DNS name like this:

bucket.vpce-0e25b8cdd720f900e-argc85vg.s3.us-east-1.vpce.amazonaws.com

Now, I have an EC2 instance. Let's try AWS S3 call with VPCE.

The security group attached to the VPCE is blocking incoming connections on port 443. Updated security group below.

Now, I can list my buckets via VPCE. The VPCE also has policy, through which we can restrict access to bucket. Similar to IAM based.

Updating VPCE to restrict access to single bucket.

Thats it. Hope you all enjoyed it. Please share the page with your friends.