AWS VPC Gateway Endpoints
- A VPC Gateway Endpoint is a gateway that is a target for a specified route in the route table, used for traffic destined for a supported AWS service.
- VPC Gateway Endpoints currently supports S3 and DynamoDB services
- VPC Gateway Endpoints do not require an Internet gateway or a NAT device for the VPC.
- Gateway endpoints do not enable AWS PrivateLink.
- VPC Endpoint policy and Resource-based policies can be used for fine-grained access control.
Gateway Endpoint Configuration
- Endpoint requires the VPC and the service to be accessed via the endpoint.
- The endpoint needs to be associated with the Route table and the route table cannot be modified to remove the route entry. It can only be deleted by removing the Endpoint association with the Route table
- A route is automatically added to the Route table with a destination that specifies the prefix list of service and the target with the endpoint id for e.g. A rule with destination pl-68a54001 (com.amazonaws.us-west-2.s3) and a target with this endpoints’ ID (e.g. vpce-12345678) will be added to the route tables
- Access to the resources in other services can be controlled by endpoint policies
- Security groups need to be modified to allow outbound traffic from the VPC to the service that is specified in the endpoint. Use the service prefix list ID for e.g.
com.amazonaws.us-east-1.s3as the destination in the outbound rule - Multiple endpoints can be created in a single VPC, for e.g., to multiple services.
- Multiple endpoints can be created for the same service but in different route tables.
- Multiple endpoints to the same service CAN NOT be specified in a single route table
Gateway Endpoint Limitations
- are regional and supported within the same Region only.
- cannot be created between a VPC and an AWS service in a different region.
- support IPv4 traffic only.
- cannot be transferred from one VPC to another, or from one service to another service.
- connections cannot be extended out of a VPC i.e. resources across the VPN, VPC peering, Direct Connect connection cannot use the endpoint.
VPC Endpoint policy
- VPC Endpoint policy is an IAM resource policy attached to an endpoint for controlling access from the endpoint to the specified service.
- Endpoint policy, by default, allows full access to any user or service within the VPC, using credentials from any AWS account to any S3 resource; including S3 resources for an AWS account other than the account with which the VPC is associated
- Endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies).
- Endpoint policy can be used to restrict which specific resources can be accessed using the VPC Endpoint.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
{ "Sid": "AccessToSpecificBucket", "Effect": "Allow", "Principal": "*", "Action": [ "s3:ListBucket", "s3:GetObject", ], "Resource": [ "arn:aws:s3:::example-bucket", "arn:aws:s3:::example-bucket/*" ] } |
S3 Bucket Policies
- IAM policy or bucket policy can’t be used to allow access from a VPC IPv4 CIDR range as the VPC CIDR blocks can be overlapping or identical, which might lead to unexpected results.
aws:SourceIpcondition can’t be used in the IAM policies for requests to S3 through a VPC endpoint.- S3 Bucket Policies can be used to restrict access through the VPC endpoint only.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
{ "Version": "2012-10-17", "Id": "Access-to-bucket-using-specific-endpoint", "Statement": [ { "Sid": "Access-to-specific-VPCE-only", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": ["arn:aws:s3:::example_bucket", "arn:aws:s3:::example_bucket/*"], "Condition": { "StringNotEquals": { "aws:sourceVpce": "vpce-1a2b3c4d" } } } ] } |
VPC Gateway Endpoint Troubleshooting
- Verify the services are within the same region.
- DNS resolution must be enabled in the VPC
- Route table should have a route to S3 using the gateway VPC endpoint.
- Security groups should have outbound traffic allowed VPC endpoint.
- NACLs should allow inbound and outbound traffic.
- Gateway Endpoint Policy should define access to the resource
- Resource-based policies like the S3 bucket policy should allow access to the VPC endpoint or the VPC.
AWS Certification Exam Practice Questions
- Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
- AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
- AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
- Open to further feedback, discussion and correction.
- You have an application running on an Amazon EC2 instance that uploads 10 GB video objects to amazon S3. Video uploads are taking longer than expected inspite of using multipart upload cause of internet bandwidth, resulting in poor application performance. Which action can help improve the upload performance?
- Apply an Amazon S3 bucket policy
- Use Amazon EBS provisioned IOPS
- Use VPC endpoints for S3
- Request a service limit increase
- What are the services supported by VPC endpoints, using Gateway endpoint type? Choose 2 answers
- Amazon S3
- Amazon EFS
- Amazon DynamoDB
- Amazon Glacier
- Amazon SQS
- An application running on EC2 instances processes sensitive information stored on Amazon S3. The information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk. Which solution will resolve the security concern?
- Access the data through an Internet Gateway.
- Access the data through a VPN connection.
- Access the data through a NAT Gateway.
- Access the data through a VPC endpoint for Amazon S3.
Master components
