Discussion on "AWS Gateway VPC endpoint S3 with CDK"

Lloyd Mckie · 2021-04-05T02:36:56.579Z

AWS Gateway VPC endpoints allow us to setup private access to the s3 buckets we control and restrict access. What do we need? CDK. see on how to set it up. A Vpc with subnets that need access to s3. // vpcendpoint-stack.ts const vpc = ec2.Vpc.fromLo...

Pretty nifty! Do you have a use case for this?

I <3 AWS CDK! Thank you!

Thanks. So typical use cases for this are to limit S3 access to private traffic only. As we're all to familiar with buckets becoming public. Details My requests are not traversing the public internet to communicate with S3 and have better security around the S3 access to objects and access through the VPC endpoint. If I want to lock down access to EC2 then I can add in the principals that have access. Better yet I can restrict access with an explicit deny to only EC2. I've posted about VPC flow logs, that would be one that we would want to protect from modification or corruption of the logs. I can extend this with S3 Access points if it's decided that this isn't enough and we want granular access to objects in the bucket. I might cover this in Part 2.

Lloyd Mckie

Ah very nice! I wonder if this could help save on any S3 costs if you are using a VPC endpoint.

Phillip Ninan maybe. I would imagine the private link costs would come to something like this where your data outbound costs would add up. the private link and s3 storage for internal connections would be less. this doesn't calculate the maintenance costs you would incur. so going external " s3 transfer costs" vs "s3 gateway" + "privatelink"

Search Hashnode

AWS Gateway VPC endpoint S3 with CDK

Responses1