Thanks. So typical use cases for this are to limit S3 access to private traffic only. As we're all to familiar with buckets becoming public. Details My requests are not traversing the public internet to communicate with S3 and have better security around the S3 access to objects and access through the VPC endpoint. If I want to lock down access to EC2 then I can add in the principals that have access. Better yet I can restrict access with an explicit deny to only EC2. I've posted about VPC flow logs, that would be one that we would want to protect from modification or corruption of the logs. I can extend this with S3 Access points if it's decided that this isn't enough and we want granular access to objects in the bucket. I might cover this in Part 2.