Cross account S3 static website access over VPN only

Question

I'm trying to allow access to s3 bucket static website over VPN from network aws account, bucket in prod account.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": "account-prod",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpc": "vpc-1"
                }
            }
        }
       {
            "Sid": "",
            "Effect": "Allow",
            "Principal": "account-network",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpc": "vpc-2"  <<<>>> tried SourceVpce as well           
                }
            }
        }
    ]
}

I used VPC endpoint interface in the account where VPN is setup, I tried using Condition SourceVpc and SourceVpce but non worked.

I'm using transit gateway and aws client vpn and allowed s3 endpoint IPs on the vpn endpoint + SGs + auth rules. (tgw is used and s3 prefix list, route entry from s3 prefix list via tgw)

bucket uses object owner + private ACL + bucket policy and I tried adding grantee with the canonical account id.

Any ideas what am I doing wrong here?

This currently works in the prod account as we have another VPN solution that runs there, we are trying to migrate everything to network account and move to aws client vpn.

Answer 1

Any ideas what am I doing wrong here?

Yes. s3 bucket static website can only be accesses over the Internet . You can't access them using private IP addresses from VPC or VPN. If you use VPN, you have to setup some proxy which will access the website using the internet, and then pass it back to your host.

Answer 2

Make sure that your VPC Subnet route table has a route to the S3 endpoint, and the policy for the endpoint is giving access.

https://tomgregory.com/when-to-use-an-aws-s3-vpc-endpoint/

next, setup your bucket policy as below, try to give access from the source of your VPC Endpoint, and not the VPC itself. (note the vpce in the policy doc).

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html