从 VPC 访问 S3 存储桶

Question

I'm running a NodeJS script and using the aws-sdk package to write files to an S3 bucket. This works fine when I run the script locally, but not from a ECS Fargate service, that's when I get Error: AccessDenied: Access Denied .

The service has the allowed VPC vpc-05dd973c0e64f7dbc . I've tried adding an Internet Gateway to this VPC, and also an endpoint (as seen in the attached image) - but nothing resolves the Access Denied error. Any ideas what I'm missing here?

SOLVED: the problem was me misunderstanding aws:sourceVpce. It requires the VPC endpoint id and not the VPC id. **

Endpoint

Internet Gateway

Bucket policy:

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3MKW5OAU5CHLI"
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::mywebsite.com/*"
        },
        {
            "Sid": "Stmt1582486025157",
            "Action": "s3:*",
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::mywebsite.com/*",
            "Principal": "*",
            "Condition": {
                "StringEquals": {
                    "aws:sourceVpce": "vpc-05dd973c0e64f7dbc"
                }
            }
        }
    ]
}

Answer 1

Please add an bucket policy that allows access from the VPC endpoint.

Update your bucket policy with a condition, that allows users to access the S3 bucket when the request is from the VPC endpoint that you created. To white list those users to download objects, you can use a bucket policy that's similar to the following:

Note: For the value of aws:sourceVpce , enter the VPC endpoint ID of the endpoint that you created.

{
   "Version": "2012-10-17",
   "Id": "Policy1314555909999",
   "Statement": [
     {
       "Sid": "<<Access-to-specific-VPConly>>",
       "Principal": "*",
       "Action": "s3:GetObject",
       "Effect": "Allow",
       "Resource": ["arn:aws:s3:::awsexamplebucket/*"],
       "Condition": {
         "StringEquals": {
           "aws:sourceVpce": "vpce-1c2g3t4e"
         }
       }
     }
   ]
}