A company routes all of its EC2 traffic to a particular S3 bucket through one specific gateway VPC endpoint and wants to deny every request to that bucket that does not arrive through that exact endpoint, including requests made from the AWS Management Console or from outside the VPC entirely. Which bucket policy element achieves this?
- A Deny statement using a StringNotEquals condition on the aws:SourceVpce key, matching everything except that endpoint's ID
- An Allow statement naming the VPC endpoint's ARN as the policy Principal
- An S3 Object Lock configuration referencing the VPC endpoint ID
- A CORS rule restricting AllowedOrigins to the VPC endpoint's DNS name
Why A? And why not the others?
Correct answer: A. A Deny statement using a StringNotEquals condition on the aws:SourceVpce key, matching everything except that endpoint's ID
AWS's example bucket policies for controlling access from VPC endpoints use exactly this pattern: a Deny statement with a StringNotEquals condition on the aws:SourceVpce key, naming the one permitted VPC endpoint ID; because the condition evaluates true for every request whose source VPC endpoint does not equal that ID, the Deny fires for every other path in, including console requests, which do not originate from any VPC endpoint at all, and requests from clients outside the VPC entirely. AWS documentation notes explicitly that a policy shaped this way disables console access to the bucket precisely because the console doesn't route through the named endpoint, which matches the company's stated intent to block everything except that one endpoint. A Principal element identifies who is making a request (an account, user, or role); it has no mechanism for constraining which network path or VPC endpoint a request travels through, so naming the endpoint's ARN as a Principal would not achieve any routing restriction and is not even a valid use of that element. Object Lock only governs whether an object version can be deleted or overwritten during a retention period and has no concept of VPC endpoints or network-path restriction at all. A CORS rule only controls whether a browser permits cross-origin JavaScript requests based on the page's origin domain; it does not evaluate or restrict which VPC endpoint a request arrived through, and non-browser clients such as backend EC2 applications are not subject to CORS enforcement in the first place.
Source: AWS S3 documentation: Controlling access from VPC endpoints with bucket policies — example Deny policy using StringNotEquals on aws:SourceVpce to restrict access to one specific VPC endpoint