Question

A company runs EC2 instances in a private subnet with no internet access. The instances use a gateway VPC endpoint to reach Amazon S3. Security requires that instances in this VPC can only access two specific company-owned S3 buckets and nothing else through the endpoint, even if an instance's IAM role were misconfigured to allow broader S3 access. Which approach BEST enforces this restriction?

Accepted Answer

Attach an endpoint policy to the gateway VPC endpoint that allows access only to the two specified bucket ARNs and their objects.

Answer

Add a bucket policy to each of the two buckets allowing access from the VPC's CIDR range using the aws:SourceIp condition.

Answer

Modify the security groups on the EC2 instances to allow outbound HTTPS only to the S3 prefix list.

Answer

Create an IAM permissions boundary on the instance role limiting it to the two buckets.