Ravi Sir's Cards › AWS
Restrict to VPC endpoint
This revision card explains Restrict to VPC endpoint. It starts from the need that private data should not leave the VPC path to the public S3 endpoint. It describes deny s3 — * unless aws:SourceVpce matches your gateway/interface endpoint id. The how-to section covers how to create endpoint , then routes , then bucket Deny-unless , then test in-VPC allow / internet deny. An example on the card is lucas Meyer ETL in private subnets reads S3 only via vpce-….
Read card text
What this card says
Why do we need it?
Private data should not leave the VPC path to the public S3 endpoint.
What is it?
Deny s3:* unless aws:SourceVpce matches your gateway/interface endpoint id.
SourceVpce
How to do it
Create endpoint → routes → bucket Deny-unless → test in-VPC allow / internet deny.
Example
Lucas Meyer ETL in private subnets reads S3 only via vpce-….