Many organizations operate multiple Amazon S3 buckets, with some of them requiring access exclusively from applications running inside a Virtual Private Cloud (VPC). AWS VPC allows you to launch AWS resources into an isolated virtual network, providing you the scale of AWS with the security model of a traditional data center.
However, ensuring applications inside a VPC can only access specific S3 buckets can become complex. The challenge increases when multiple shared datasets must be accessed across different VPCs.
In this guide, we'll explore how to securely manage access to shared datasets in Amazon S3 using S3 Access Points in combination with VPC endpoints. We will create an Amazon S3 VPC-only Access Point and use it in a VPC endpoint policy to control access. We will also cover using bucket policies to restrict S3 bucket access entirely to VPCs.
Using Amazon S3 VPC Endpoints
VPC endpoints for Amazon S3 simplify access by providing secure and reliable connections directly to S3 without requiring an internet gateway or NAT device.
You can specify individual buckets in an Amazon S3 VPC endpoint policy to restrict access. Here is an example VPC endpoint policy that allows access to a specific S3 bucket:
{
"Statement": [
{
"Sid": "Access-to-specific-bucket-only",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::my_secure_bucket",
"arn:aws:s3:::my_secure_bucket/*"
]
}
]
}
While functional, this approach scales poorly. Whenever a new S3 bucket is created, you must manually update the VPC endpoint policy to whitelist it. S3 Access Points resolve this management overhead.
What Are S3 Access Points?
S3 Access Points are unique hostnames created to enforce distinct network controls and IAM permissions for any request routed through them.
Key features include:
- A unique hostname and AWS ARN.
- A dedicated IAM resource policy.
- Block Public Access enabled by default.
- Custom IAM permissions for users, applications, or specific prefixes within a bucket.
- The ability to restrict requests exclusively to a VPC.
Combining S3 Access Points with VPC Endpoints
Instead of specifying individual buckets, you can use an Access Point prefix in your VPC endpoint policy. This applies to all Access Points under a given AWS account and Region.
Add this condition to your VPC endpoint policy:
"Condition": {
"ArnNotLikeIfExists": {
"s3:DataAccessPointArn": "arn:aws:s3:us-east-1:<Account ID>:accesspoint/*"
}
}
With this condition, whenever a new S3 bucket is created, you simply create a new S3 Access Point for it. Access is automatically granted through the VPC endpoint policy without manual updates.
Step-by-Step Setup Guide
Let's set up an S3 Access Point and use it with a VPC endpoint.
Prerequisites
- An AWS Account with a VPC.
- A private subnet (no internet access via Internet Gateway or NAT).
- At least one Amazon S3 bucket.
1. Create a VPC-Only Access Point
First, create an Access Point that is only accessible from a specific VPC. Amazon S3 will reject any requests that do not originate from that VPC.
- In the Amazon S3 console, navigate to your bucket.
- Choose Access points > Create access point.
- Provide a unique name for the Access Point.
- For Network access type, select Virtual Private Cloud (VPC).
- Select Block all public access.
- Click Create access point and note the ARN.
2. Create an Amazon S3 Gateway Endpoint
Next, ensure all S3 traffic routes through a VPC Gateway endpoint.
- In the Amazon VPC console, navigate to Endpoints > Create Endpoint.
- Search and select the S3 service.
- Select the VPC and subnet for the endpoint.
- Under Policy, choose Custom and paste the following policy (replace
<Account ID>):
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "AllowUseOfS3",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "*"
},
{
"Sid": "OnlyIfAccessedViaAccessPoints",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "*",
"Condition": {
"ArnNotLikeIfExists": {
"s3:DataAccessPointArn": "arn:aws:s3:us-east-1:<Account ID>:accesspoint/*"
}
}
}
]
}
- Click Create Endpoint.
Restricting S3 Bucket Access to VPC Only
To guarantee an S3 bucket is only accessible from within a VPC, apply a bucket policy.
- Navigate to the S3 bucket's Permissions tab and click Bucket Policy.
- Paste the following policy (replace
<bucket name>and<vpc id>):
{
"Version": "2012-10-17",
"Id": "S3BukcetPolicyVPCAccessOnly",
"Statement": [
{
"Sid": "DenyIfNotFromAllowedVPC",
"Effect": "Deny",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::<bucket name>",
"arn:aws:s3:::<bucket name>/*"
],
"Condition": {
"StringNotEquals": {
"aws:SourceVpc": "<vpc id>"
}
}
}
]
}
Enforcing VPC-Only Access Points via SCP
You can use a Service Control Policy (SCP) to require all new Access Points in your organization to be VPC-only. This firewalls your data to private networks organization-wide.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Deny",
"Action": [
"s3:CreateAccessPoint"
],
"Resource": [
"*"
],
"Condition": {
"StringNotEqualsIfExists": {
"s3:AccessPointNetworkOrigin": [
"vpc"
]
}
}
}
]
}
Automating with CloudFormation
For consistent deployments, you can automate S3 Access Point creation using AWS CloudFormation. A template allows you to define, update, and deploy S3 Access Points at scale across multiple accounts and Regions.
Conclusion
Managing data access at scale for shared S3 datasets can be difficult, especially when enforcing strict network boundaries. By combining S3 Access Points with VPC endpoints, you can simplify permissions management while ensuring multi-tenant S3 buckets remain secure. This architecture scales easily and minimizes manual intervention while protecting your sensitive data.