在内部网络中共享来自 AWS S3 存储桶的文件

Question

I'd like to share file test.txt from AWS S3 bucket for my internal network. User should be able to download that file via HTTP(s) without any authorization. I set tup S3 Access Point using VPC:

but when I'm trying to download it fails:

$ curl https://access-through-vpc-<account_id>.s3-accesspoint.us-west-2.amazonaws.com/test.txt
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidRequest</Code><Message>The authorization mechanism you have provided is not supported. Please use Signature Version 4.</Message><RequestId>B96D773CF3DF265B</RequestId><HostId>gAPCDvlncaP5n63h1qGK/Lkt+LReqfuHzWbdwHIUKPRk8dY1EEAisIadmeCacPc2YvGtRb+lUCU=</HostId></Error>


$ wget https://access-through-vpc-<account_id>.s3-accesspoint.us-west-2.amazonaws.com/test.txt
--2020-03-03 11:21:17--  https://access-through-vpc-<account_id>.s3-accesspoint.us-west-2.amazonaws.com/test.txt
Resolving access-through-vpc-<account_id>.s3-accesspoint.us-west-2.amazonaws.com (access-through-vpc-<account_id>.s3-accesspoint.us-west-2.amazonaws.com)... 52.218.208.209
Connecting to access-through-vpc-<account_id>.s3-accesspoint.us-west-2.amazonaws.com (access-through-vpc-<account_id>.s3-accesspoint.us-west-2.amazonaws.com)|52.218.208.209|:443... connected.
HTTP request sent, awaiting response... 400 Bad Request
2020-03-03 11:21:17 ERROR 400: Bad Request.

Can you help, please?

Answer 1

When you say "for my internal network" I am understanding as from your VPC.
You already create the S3 Access Point using Network access type VPC, which is correct to restrict the access to only your VPC.

In order for S3 understand the access comes from your VPC you need to have a VPC Endpoint for S3 and configure your route tables to use this Endpoint.
Otherwise your requests to S3 will be made via internet, which will give you "forbidden access"

As you are blocking all public access, your instances will requires an role with permission to this bucket.
If you really want to avoid authentication, you need to set Bucket policy and Access Point policy according.

In the link below it explain the process to use VPC Endpoint and S3 Access Points.
https://docs.aws.amazon.com/AmazonS3/latest/dev/creating-access-points.html