How to Access Amazon S3 Buckets from Your VPC or On-Premises Network

How to Access Amazon S3 Buckets from Your VPC or On-Premises Network

Amazon S3 is a popular cloud storage service that allows you to store and retrieve any amount of data from anywhere on the web. However, accessing S3 buckets from your virtual private cloud (VPC) or on-premises network can be challenging if you don’t know the best practices and options available. In this article, I will explain the differences between three methods of accessing S3 buckets: S3 gateway endpoint, S3 interface endpoint, and S3 access endpoint. I will also provide some examples of how to use them and compare their advantages and limitations.

What are S3 endpoints?

S3 endpoints are network endpoints that allow you to connect to S3 from your VPC or on-premises network. They enable you to access S3 buckets without going through the public internet, which can improve performance, security, and cost efficiency. There are three types of S3 endpoints: gateway endpoint, interface endpoint, and access endpoint. Let’s look at each of them in detail.

S3 gateway endpoint

A S3 gateway endpoint is a gateway that you specify in your VPC route table to access S3 from your VPC over the AWS network. It does not require an internet gateway or a NAT device for your VPC, and there is no additional charge for using it. However, it does not allow access from on-premises networks, from peered VPCs in other AWS Regions, or through a transit gateway. For those scenarios, you must use an interface endpoint, which is available for an additional cost.

To create a S3 gateway endpoint, you need to select the service name com.amazonaws.region.s3 in the VPC console, and choose the route tables that you want to associate with the endpoint. You can also attach an endpoint policy to control access to S3 buckets. For example, the following policy allows access to a specific bucket only:

{
  "Statement": [
    {
      "Sid": "Access-to-specific-bucket-only",
      "Principal": "*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::my_secure_bucket",
        "arn:aws:s3:::my_secure_bucket/*"]
    }
  ]
}

S3 interface endpoint