Securing Amazon S3 with VPC Endpoints and Access Points
Managing data access for shared datasets in Amazon S3 can quickly become complicated when multiple applications in different Virtual Private Clouds (VPCs) require access. Ensuring that sensitive data is only accessible from your private networks makes this even more challenging.
In this guide, we will explore how to combine Amazon S3 VPC Endpoints with S3 Access Points to securely manage access to shared datasets, effectively creating a firewall around your S3 data to prevent unauthorized external access.
Securing Access with VPC Endpoints
When you configure an AWS VPC endpoint for Amazon S3, you create a private connection between your VPC and S3. This traffic doesn't require an internet gateway or NAT device.
Organizations often use VPC endpoint policies to restrict access to specific buckets:
{
"Statement": [
{
"Sid": "Access-to-specific-bucket-only",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::my_secure_bucket",
"arn:aws:s3:::my_secure_bucket/*"
]
}
]
}
However, as you create more buckets, manually updating this policy becomes tedious and error-prone. This is where S3 Access Points provide a more scalable solution.
How S3 Access Points Work
S3 Access Points are unique hostnames that enforce distinct permissions and network controls.
Key benefits include:
- A unique AWS ARN and hostname.
- Default blocking of public access.
- Custom IAM resource policies for precise control.
- Ability to restrict requests to originate only from a specific VPC.
To simplify AWS S3 management, you can configure your VPC endpoint policy to allow access to all Access Points within your account, rather than listing individual buckets.
Creating the VPC Endpoint Policy
Here is how you can set up a VPC endpoint policy that allows S3 access only if it goes through an Access Point owned by your account:
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "AllowUseOfS3",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "*"
},
{
"Sid": "OnlyIfAccessedViaAccessPoints",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "*",
"Condition": {
"ArnNotLikeIfExists": {
"s3:DataAccessPointArn": "arn:aws:s3:us-east-1:<Account ID>:accesspoint/*"
}
}
}
]
}
With this policy, any new bucket can simply be assigned a VPC-only Access Point. The VPC will automatically be able to communicate with it, eliminating the need to update the endpoint policy.
Restricting Bucket Access to a VPC
To ensure your data cannot be accessed from outside your VPC, you should add a bucket policy. This explicitly denies access unless the request originates from your authorized VPC.
{
"Version": "2012-10-17",
"Id": "S3BukcetPolicyVPCAccessOnly",
"Statement": [
{
"Sid": "DenyIfNotFromAllowedVPC",
"Effect": "Deny",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::<bucket name>",
"arn:aws:s3:::<bucket name>/*"
],
"Condition": {
"StringNotEquals": {
"aws:SourceVpc": "<vpc id>"
}
}
}
]
}
Enforcing VPC-Only Access Points Organization-Wide
To guarantee security at scale, you can implement a Service Control Policy (SCP) that forces all new S3 Access Points to be VPC-only.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Deny",
"Action": [
"s3:CreateAccessPoint"
],
"Resource": [
"*"
],
"Condition": {
"StringNotEqualsIfExists": {
"s3:AccessPointNetworkOrigin": [
"vpc"
]
}
}
}
]
}
Conclusion
Managing multi-tenant data on Amazon S3 requires scalable security. By leveraging VPC Endpoints together with S3 Access Points, you can build a robust architecture that isolates your sensitive data from the public internet. This approach reduces manual policy management while ensuring compliance and security across your AWS environment.