Question

A CloudOps engineer created a Gateway VPC endpoint for Amazon S3 so that EC2 instances in private subnets can reach S3 without traversing a NAT gateway. Route tables and security groups are correctly configured, and instances can list and download from any S3 bucket. However, the security team requires that traffic through this endpoint be allowed to reach ONLY two specific corporate buckets and be denied access to all other buckets, including buckets in other AWS accounts. What is the MOST appropriate way to enforce this restriction?

Accepted Answer

Attach an endpoint policy to the S3 Gateway endpoint that allows actions only on the two specific bucket ARNs and denies all others.

Answer

Modify the route table associated with the private subnets to add explicit routes only to the CIDR ranges of the two allowed buckets.

Answer

Add outbound security group rules on the EC2 instances that allow HTTPS only to the prefix list of the two allowed buckets.

Answer

Create a NACL on the private subnets that denies all S3 traffic except to the IP ranges of the two allowed buckets.