Question

A financial services company stores confidential documents in an S3 bucket. Security requires that the bucket be accessible ONLY from resources inside the company's VPC, and never from the public internet, even if someone obtains valid IAM credentials. A VPC gateway endpoint for S3 has already been created. What should the solutions architect implement to enforce this requirement at the bucket level?

Accepted Answer

Add an S3 bucket policy with a Deny statement that uses the aws:sourceVpce condition key to allow access only when the request comes through the specific VPC endpoint.

Answer

Attach an IAM identity policy to all users that includes an aws:SourceIp condition restricting access to the VPC's private CIDR range.

Answer

Enable S3 Block Public Access on the bucket and rely on the VPC endpoint route table to prevent internet access.

Answer

Configure a security group on the S3 bucket allowing inbound traffic only from the VPC endpoint's elastic network interface.