By Implementation

Service Control PoliciesConfig RulesAuto Remediation RulesConformance PacksAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallRoute53 Resolver SecurityAmazon MacieS3 Bucket PoliciesCloudWatch Alarms and Event RulesAWS WAFAWS Secrets ManagerAWS Systems ManagerSecurity Groups & NACLsAWS KMSIAM PoliciesVPC Endpoint PoliciesAmazon ECRRDS Event Subscriptions

By Service Protected

Configuration Packages

Strategy Guides

Other

By Service Protected

By Implementation

Service Control PoliciesConfig RulesAuto Remediation RulesConformance PacksAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallRoute53 Resolver SecurityAmazon MacieS3 Bucket PoliciesCloudWatch Alarms and Event RulesAWS WAFAWS Secrets ManagerAWS Systems ManagerSecurity Groups & NACLsAWS KMSIAM PoliciesVPC Endpoint PoliciesAmazon ECRRDS Event Subscriptions

Configuration Packages

Strategy Guides

Other

S3 Bucket Policies

Restrict Access to S3 Bucket to a Specific VPC Endpoint

An S3 Bucket policy that denies all access to the bucket if the specified VPC endpoint is not being used to access the S3 bucket.

AWS Documentation: Example Bucket Policies for VPC Endpoints for Amazon S3
Missing Parameters
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ],
            "Effect": "Deny",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": ""
                }
            }
        }
    ]
}

Actions



Customize Template

Policy Parameters

* Required field
Amazon S3 Bucket
Configuration to create an S3 bucket with security configuration options including s3 block public access configuration, encryption, logging, and versioning
Configuration Item
Amazon S3 Bucket
Configuration to create an S3 bucket with security configuration options including s3 block public access configuration, encryption, logging, and versioning
Configuration Item