S3 Bucket Policies - Restrict Access to S3 Bucket to a Specific VPC Endpoint

An S3 Bucket policy that denies all access to the bucket if the specified VPC endpoint is not being used to access the S3 bucket.

Policy|CloudFormation |AWS CLI |

Terraform

Missing Parameters

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ],
            "Effect": "Deny",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": ""
                }
            }
        }
    ]
}

* Required field

Configuration Source: AWS Documentation: Example Bucket Policies for VPC Endpoints for Amazon S3

Additional Documentation:

AWS Documentation: Add/Edit S3 Bucket Policies (Manual Steps)
AWS Documentation: S3 Bucket Policy Language Overview
CloudFormation Reference Guide: S3 Bucket Policies
AWS CLI Command Reference Guide: S3 Bucket Policies

Configuration to create an S3 bucket with security configuration options including s3 block public access configuration, encryption, logging, and versioning

Configuration Item

Security Control

Configuration Packages

Service

Security Strategy Guides

Solutions, Guides & Tools

Overview

Configuration Templates

Actions

Customize Template

Policy Parameters

Sources and Documentation