EC2 instances in a private subnet access S3.
Restrict the bucket that can be reached through the endpoint.
Which control is most appropriate?
Use a Gateway VPC endpoint policy that specifies the allowed S3 bucket and actions.
Detailed explanation
DNS resolution does not control S3 API authorization.
DNS resolution does not control S3 API authorization.
A NAT name does not grant or restrict S3 permissions.
A NAT name does not grant or restrict S3 permissions.
The endpoint policy can limit S3 API actions and resources reached through that endpoint.
The endpoint policy can limit S3 API actions and resources reached through that endpoint.
A CDN policy is not an endpoint authorization policy.
A CDN policy is not an endpoint authorization policy.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 VPC endpoint policiesの公式説明を確認する。
What to confirm
ルート経路とEndpoint policyの権限制御を区別できる。
Key points
- Gateway VPC endpoint
- Endpoint policy
- S3 bucket
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Path versus permission
The route reaches S3; endpoint and bucket policies decide which requests are authorized.
Gateway scope
Gateway endpoints are service-specific and do not provide a general internet path.