Managing Amazon S3 Access with VPC Endpoints and S3 Access Points

Many organizations run applications within private networks using Amazon VPC and need to ensure these applications can securely access data stored in Amazon S3. When managing multiple shared datasets across different VPCs, controlling access and permissions can become a significant challenge.

In this guide, we will explore an approach that combines S3 Access Points with VPC Endpoint Policies to simplify and secure access management for shared datasets on Amazon S3.

By creating a VPC-only S3 Access Point and leveraging it within your VPC endpoint policy, you can firewall your data, ensuring it is only accessible from your designated private networks.

Using Amazon S3 VPC Endpoints

VPC endpoints for Amazon S3 allow you to connect your VPC directly to S3 without requiring an Internet Gateway, NAT Gateway, or public IP addresses. This provides a highly reliable and secure connection.

When you create an S3 VPC endpoint, you can attach an endpoint policy to control access. Organizations often try to specify individual buckets within the VPC endpoint policy to ensure that applications inside the VPC can only access those specific buckets.

Here is an example of a VPC endpoint policy that allows access to a single, specific S3 bucket:

{
  "Statement": [
    {
      "Sid": "Access-to-specific-bucket-only",
      "Principal": "*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::my_secure_bucket",
        "arn:aws:s3:::my_secure_bucket/*"
      ]
    }
  ]
}

While this works, it does not scale well. As the number of buckets grows, manually updating the VPC endpoint policy every time a new bucket is created becomes tedious and error-prone. This is where S3 Access Points offer a better solution.

What Are S3 Access Points?

S3 Access Points are unique hostnames created to enforce distinct permissions and network controls for any request made through them.

Key features of S3 Access Points include:

They contain a unique hostname, an AWS ARN, and an AWS IAM resource policy.
They block public access by default.
They are unique to an AWS account and Region.
They can enforce custom IAM permissions for users or applications.
They can be configured to accept requests only from a VPC, restricting data access to your private network.

By using an Access Point prefix in your VPC endpoint policy, you can allow access to all Access Points under a specific account, eliminating the need to manually list every single bucket.

Step 1: Create a VPC-only Access Point

First, we need to create an S3 Access Point that is only accessible from a specified VPC. Any request made to this Access Point from outside the VPC will be rejected.

Navigate to the Amazon S3 console and select the bucket you want to share.
Go to the Access points tab.
Click Create access point.
Provide a unique name for the Access Point.
For the Network access type, select Virtual Private Cloud (VPC) and input your VPC ID.
Ensure Block all public access is enabled.
Click Create access point and note the ARN of the created Access Point.

Step 2: Create an Amazon S3 Gateway Endpoint

Next, create an S3 Gateway Endpoint in your VPC to route all S3 traffic securely.

Navigate to the Amazon VPC console.
Click Endpoints from the left menu and choose Create Endpoint.
Search for and select the S3 service (ensure the Type is Gateway).
Select the VPC and route tables for the subnets that require access.
Under the Policy section, select Custom and paste the following policy, replacing <Account ID> with your actual AWS Account ID:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowUseOfS3",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "*"
        },
        {
            "Sid": "OnlyIfAccessedViaAccessPoints",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "*",
            "Condition": {
                "ArnNotLikeIfExists": {
                    "s3:DataAccessPointArn": "arn:aws:s3:us-east-1:<Account ID>:accesspoint/*"
                }
            }
        }
    ]
}

This policy uses a wildcard (*) for the Access Point ARN. It automatically allows access to any newly created S3 Access Point within the account, removing the burden of manual updates.

Step 3: Restrict the S3 Bucket to VPC Access Only

To guarantee that the bucket itself cannot be accessed directly from the internet (bypassing the Access Point), you should add a bucket policy that restricts access strictly to the VPC.

Navigate to your S3 bucket's Permissions tab, edit the Bucket Policy, and apply the following configuration (replace <bucket name> and <vpc id> with your actual details):

{
    "Version": "2012-10-17",
    "Id": "S3BucketPolicyVPCAccessOnly",
    "Statement": [
        {
            "Sid": "DenyIfNotFromAllowedVPC",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket name>",
                "arn:aws:s3:::<bucket name>/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:SourceVpc": "<vpc id>"
                }
            }
        }
    ]
}

Enforcing VPC-Only Access Points Organization-Wide

For enhanced security governance, you can use AWS Organizations Service Control Policies (SCPs) to mandate that any new S3 Access Point must be restricted to a VPC.

Applying the following SCP at the root, organizational unit, or account level ensures that your data remains firewalled within your private networks:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "RequireVPCAccessPoints",
            "Effect": "Deny",
            "Action": [
                "s3:CreateAccessPoint"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringNotEqualsIfExists": {
                    "s3:AccessPointNetworkOrigin": [
                        "vpc"
                    ]
                }
            }
        }
    ]
}

Conclusion

Managing data permissions at scale for shared Amazon S3 datasets can be complex, especially when strict network security boundaries are required.

By combining S3 VPC Endpoints with VPC-only S3 Access Points, you can securely expose multi-tenant buckets to your internal applications without the operational overhead of constantly updating endpoint policies. This approach allows your infrastructure to scale seamlessly while ensuring that sensitive data is strictly firewalled inside your AWS VPC.