An IAM role in the same account already has Allow for s3:GetObject on the target bucket objects; other authorization prerequisites are met. Deny GetObject that does not use the selected VPC endpoint even when IAM allows it.
The scope is direct role GetObject requests; service-mediated requests are outside this question. Console reads need no exception. The endpoint and routes are prepared; retain legitimate reads through the selected endpoint.
Which bucket-policy change meets the requirements?
Apply explicit Deny to GetObject outside the selected endpoint while retaining existing authorization through that endpoint.
Detailed explanation
An endpoint policy controls requests using that endpoint. It does not replace a bucket-policy Deny for requests bypassing it, or override IAM and bucket policies.
An endpoint policy controls requests using that endpoint. It does not replace a bucket-policy Deny for requests bypassing it, or override IAM and bucket policies.
This reverses the condition and denies the reads that must remain available. Deny requests not matching the selected ID and verify both allowed and excluded paths.
This reverses the condition and denies the reads that must remain available. Deny requests not matching the selected ID and verify both allowed and excluded paths.
Explicit Deny overrides the existing IAM Allow. Deny other endpoints and direct requests without SourceVpce; reads through the selected endpoint are evaluated using existing permissions and other prerequisites. Being outside this Deny does not itself grant access.
Explicit Deny overrides the existing IAM Allow. Deny other endpoints and direct requests without SourceVpce; reads through the selected endpoint are evaluated using existing permissions and other prerequisites. Being outside this Deny does not itself grant access.
The existing same-account IAM Allow still applies on other paths. Adding a conditional Allow does not remove those permissions; an explicit Deny is needed for the excluded paths.
The existing same-account IAM Allow still applies on other paths. Adding a conditional Allow does not remove those permissions; an explicit Deny is needed for the excluded paths.
Check official documentation
Compare the following points with the official documentation.
Review official condition evaluation and policy examples. In an approved test bucket, compare reads of the same object by the same role through the selected endpoint, another endpoint, and a path without an endpoint.
Official references
- Official documentation 1
- Official documentation 2
- Official documentation 3
- Official documentation 4
- Official documentation 5
- Official documentation 6
What to confirm
Existing permissions allow reads through the selected endpoint. Another endpoint and direct requests without SourceVpce are denied, including console GetObject. Conditional Allow and endpoint policy alone do not restrict every path.
Key points
- aws:SourceVpce
- StringNotEquals
- S3 bucket policy
Notes
- Environment: Official IAM, S3, and VPC documentation and approved test bucket, role, endpoints, and routes
- Reviewed against the linked AWS documentation on 2026-10-13.
Foundation review
Distinguish adding permission from denying excluded paths
In this same-account scenario, IAM and resource-policy Allow permissions are evaluated together. An endpoint-conditioned Allow does not remove existing IAM authorization on other paths. Deny s3:GetObject on the target objects with StringNotEquals on aws:SourceVpce; explicit Deny overrides Allow.
Check the endpoint ID and absent context key
aws:SourceVpce contains an endpoint ID, not an endpoint ARN, and is present only for endpoint requests. StringNotEquals also matches a request without that key. Matching the selected ID avoids this Deny but does not itself grant permission; IAM, endpoint policy, other denials, and routing prerequisites still matter.
Verify scope and actual request paths
Endpoint policy controls requests using that endpoint; it does not replace bucket-policy restrictions on bypass paths. This Deny covers GetObject, including console object reads. Service-mediated calls are excluded from this scenario; production designs must separately consider missing network context and approved exceptions. Test both legitimate and denied paths.