Ravi Sir's Cards › AWS
Endpoint policy layers
This revision card explains Endpoint policy layers. It starts from the need that bucket policy alone is not the whole story — endpoint policies apply too. It describes align both; fix routes to the S3 prefix list; confirm no NAT leak for the deny test. The how-to section notes from bastion in VPC — allow. From laptop: deny. An example on the card is ananya Iyer debugs missing route table association first.
Read card text
What this card says
Why do we need it?
Bucket policy alone is not the whole story — endpoint policies apply too.
What is it?
Align both; fix routes to the S3 prefix list; confirm no NAT leak for the deny test.
prefix list
How to do it
From bastion in VPC: allow. From laptop: deny.
Example
Ananya Iyer debugs missing route table association first.