Restricting S3 bucket access to a VPC

Question

I am trying to apply the following policy in order to restrict my_bucket's access to a particular VPC.

When I try to apply this as a bucket policy, I get an Policy has an invalid condition key - ec2:Vpc.

How do I correct this?

{    "Version": "2012-10-17",    "Statement": [       {          "Effect": "Deny",          "Principal": {             "AWS": "*"          },          "Action": "*",          "Resource": "arn:aws:s3:::my_bucket/*",          "Condition":{             "StringNotEquals": {                "ec2:Vpc": "arn:aws:ec2:region:account:vpc/vpc-ccccccc"             }          }       }    ] } 

Answer 1

I just got this to work. I had to do two things. 1) Create the bucket policy on the S3 bucket, 2) create a "VPC Endpoint"

My S3 bucket policy looks like this (of course put in your bucket name and VPC identifier):

{     "Version": "2012-10-17",     "Id": "Policy1234567890123",     "Statement": [         {             "Sid": "Stmt1234567890123",             "Effect": "Allow",             "Principal": "*",             "Action": "s3:*",             "Resource": "arn:aws:s3:::my_bucket/*",             "Condition": {                 "StringEquals": {                     "aws:sourceVpc": "vpc-12345678"                 }             }         }     ] } 

The S3 bucket also has some permissions outside the bucket policy to allow access from the AWS Console. Doing the above did not give access. To get access, I also had to go to AWS Console -> VPC -> Endpoints, and then create an endpoint. I attached the newly created endpoint to the only routing policy the account has at the moment (that has all subnets attached to it) and I used the default policy of

{     "Statement": [         {             "Action": "*",             "Effect": "Allow",             "Resource": "*",             "Principal": "*"         }     ] } 

Once I created the endpoint, I was able to read from the S3 bucket from any EC2 instance in my VPC simply using wget with the right URL. I am still able to access the bucket from the AWS Console. But if I try to access the URL from outside the VPC, I get 403 forbidden. Thus, access to the S3 bucket is restricted to a single VPC, just like what you are looking for.

This is apparently a new feature. See this AWS blog entry for more information.