Amazon Web Services AWS Certified Specialty SCS-C02 Question # 3 Topic 1 Discussion

Restrict Access Using S3 Bucket Policy:

Use the aws:SourceVpc condition key in the S3 bucket policy to ensure that requests are only allowed from the specified VPC ID.

Example Bucket Policy:

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

The following bucket policy ensures requests originate from the same VPC:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:*","Resource": ["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-xxxxxxxx"}}}]}

Advantages:

Prevents misuse of credentials in unauthorized VPCs.

Adds an additional layer of security by limiting S3 access to specific VPCs.

Test and Validate:

Verify that only requests from the allowed VPC can access the S3 bucket.

References:

AWS S3 Bucket Policy Conditions

AWS Condition Keys for S3