S3 Endpoint Gateway Setup IAM and S3 Policy

This IAM policy is designed to deny access to specific S3 actions unless the request comes from a specific VPC endpoint (VPCE). Here’s a breakdown of the policy:

1. Policy Version:

   "Version": "2012-10-17"

2. Statement Block:

   "Statement": [
     {
       "Sid": "Allow-access-to-specific-VPCE",
       "Effect": "Deny",
       "Principal": "*",
       "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
       "Resource": ["arn:aws:s3:::bucket_name", "arn:aws:s3:::bucket_name/*"],
       "Condition": {
         "StringNotEquals": {
           "aws:sourceVpce": "vpce-1a2b3c4d"  # vpce ID 
         }
       }
     }
   ]

Detailed Explanation:

• Sid: "Allow-access-to-specific-VPCE"

  • A unique identifier for the statement.

• Effect: "Deny"

  • The policy is a deny policy, which takes precedence over allow policies. It will deny the specified actions if the condition is met.

• Principal: "*"

  • This indicates that the policy applies to any user or service attempting to access the bucket.

• Action: ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]

  • These are the S3 actions that are being restricted. This policy denies putting, getting, and deleting objects unless the condition is met.

• Resource: ["arn:aws:s3:::bucket_name", "arn:aws:s3:::bucket_name/*"]

  • The S3 bucket and all objects within it that the policy applies to. Replace "bucket_name" with your actual bucket name.

• Condition:

  • StringNotEquals:
    • The condition checks if the aws:sourceVpce is not equal to the specified VPC endpoint ID (vpce-1a2b3c4d). If the request does not come from this VPC endpoint, the actions (PutObject, GetObject, DeleteObject) are denied.

Usage:

• Ensure you replace bucket_name with your actual bucket name.
• Replace vpce-1a2b3c4d with your actual VPC endpoint ID.

This policy is useful in scenarios where you want to restrict access to your S3 bucket to requests originating from a specific VPC endpoint, providing an additional layer of security by limiting access to trusted network paths.