Secure Data Access in AWS with S3 Access Points and VPC Endpoints

Managing shared datasets or databases across multiple Amazon S3 buckets can be challenging, especially when you need to enforce strict access controls for applications running within different AWS VPC networks. In this article, we'll explore how combining VPC Endpoints with S3 Access Points can simplify this process while enhancing security.

Understanding VPC Endpoints for Amazon S3

By default, Amazon S3 traffic travels over the public internet. However, if you want your applications running inside an AWS VPC to communicate with AWS S3 privately, you need to use a VPC Endpoint. These endpoints provide a highly reliable and secure connection to S3 without requiring an internet gateway or NAT device.

You can also use VPC Endpoint policies to restrict which S3 buckets can be accessed from the VPC.

{
  "Statement": [
    {
      "Sid": "Access-to-specific-bucket-only",
      "Principal": "*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::my_secure_bucket", "arn:aws:s3:::my_secure_bucket/*"]
    }
  ]
}

However, as your organization scales and you create more buckets, manually updating these endpoint policies becomes an operational bottleneck. This is where S3 Access Points come into play.

Using S3 Access Points

S3 Access Points are unique hostnames that allow you to enforce distinct network controls and permissions for any request made to Amazon S3. Each Access Point has its own ARN and policy, allowing for granular control.

If you don't want to constantly update AWS IAM permissions or VPC Endpoint policies with new bucket names, Access Points offer a scalable solution. One of their most powerful features is the ability to restrict access exclusively to a specific VPC.

Integrating VPC Endpoints with S3 Access Points

Instead of updating your VPC Endpoint policy every time a new bucket is created, you can use a wildcard condition that permits access via any Access Point owned by your organization.

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowUseOfS3",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "*"
        },
        {
            "Sid": "OnlyIfAccessedViaAccessPoints",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "*",
            "Condition": {
                "ArnNotLikeIfExists": {
                    "s3:DataAccessPointArn": "arn:aws:s3:us-east-1:<Account ID>:accesspoint/*"
                }
            }
        }
    ]
}

With this policy in place, any request from your VPC must go through an Access Point. When you create a new S3 bucket, you simply create a VPC-only Access Point for it, and the VPC Endpoint policy will automatically permit the traffic without requiring manual modification.

Locking Down S3 Buckets to VPC Access Only

To ensure that your data is completely isolated and cannot be accessed from outside your private network, you can apply a bucket policy that denies all requests that do not originate from a specific VPC.

{
    "Version": "2012-10-17",
    "Id": "S3BukcetPolicyVPCAccessOnly",
    "Statement": [
        {
            "Sid": "DenyIfNotFromAllowedVPC",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket name>",
                "arn:aws:s3:::<bucket name>/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:SourceVpc": "<vpc id>"
                }
            }
        }
    ]
}

Conclusion

Combining S3 Access Points with VPC Endpoints is a highly effective way to secure multi-tenant AWS S3 buckets. It allows organizations to scale their storage infrastructure seamlessly while enforcing strict security boundaries, ensuring that sensitive data remains firewalled within the private network.