Create and Secure an Amazon S3 Gateway VPC Endpoint – SAP-C02 Study Guide

Purpose of This Lesson

An Amazon S3 gateway VPC endpoint provides private connectivity from resources in a VPC to Amazon S3 without requiring a NAT gateway or internet gateway for S3 traffic. This lesson demonstrates how endpoint route-table associations and endpoint policies influence access.

The same design applies to Amazon DynamoDB, which also supports gateway endpoints.

Key Concepts

Gateway VPC endpoints

A gateway endpoint is a VPC routing target for supported AWS services. Gateway endpoints are available for:

• Amazon S3
• Amazon DynamoDB

Unlike interface endpoints, gateway endpoints do not use elastic network interfaces or private IP addresses in your subnets. Instead, AWS adds routes to selected route tables. These routes use an AWS-managed prefix list representing the service’s address ranges in the Region.

For an S3 gateway endpoint, the route resembles:

Destination	Target
S3 AWS-managed prefix list	VPC endpoint ID

The prefix list is maintained by AWS, so you do not need to manage changing S3 IP ranges manually.

Route-table association is required

Creating the endpoint is not sufficient. You must associate the endpoint with the route tables used by the subnets that need access to S3.

For example:

• Private-subnet route tables can send S3 traffic through the gateway endpoint.
• Public-subnet route tables can also use the endpoint if explicitly associated.
• A subnet whose route table is not associated with the endpoint will use another applicable route, such as an internet gateway or NAT gateway path.

This association is the key difference between testing endpoint behavior successfully and merely creating an unused endpoint.

Endpoint policies and IAM policies work together

Access to S3 through an endpoint is controlled by multiple policy layers:

1. Identity-based IAM policy attached to the EC2 instance role or another identity.
2. VPC endpoint policy attached to the gateway endpoint.
3. S3 bucket policy, if one is configured.
4. S3 Block Public Access and other applicable resource controls.

A request generally needs to be permitted by the relevant policy layers. An explicit deny takes precedence over an allow.

A default endpoint policy commonly permits broad access, but production designs should apply least privilege. The endpoint policy can restrict access to specific buckets, actions, or principals.

EC2 instance role for testing

An EC2 instance should use an IAM role rather than static access keys. For a read-only test, attach an AWS-managed or customer-managed policy that permits the required S3 read operations.

The role’s trust policy must allow the EC2 service principal to assume the role. Without the trust relationship, the instance cannot obtain credentials even if the permissions policy is correct.

Gateway endpoint versus interface endpoint

S3 gateway endpoints are usually the simplest and most cost-effective private access method for S3 from a VPC. Interface endpoints use AWS PrivateLink and are implemented through elastic network interfaces in selected subnets.

Do not select an S3 interface endpoint when the requirement is simply private S3 access from VPC resources and a gateway endpoint meets the requirement. Interface endpoints may be appropriate for services or access patterns that require PrivateLink features, such as private DNS or access from environments connected through certain network architectures.

Exam-Relevant Takeaways

• An S3 gateway endpoint avoids the need for a NAT gateway for S3 access.
• Gateway endpoints are configured through route tables, not subnet-level network interfaces.
• The route destination is an AWS-managed prefix list for S3, and the target is the VPC endpoint.
• Only subnets using associated route tables send matching S3 traffic through the endpoint.
• Public subnets can use a gateway endpoint; being public does not prevent endpoint routing.
• An instance in a public subnet may otherwise reach S3 through the internet gateway because S3 has public endpoints.
• An endpoint policy can allow or deny requests independently of the EC2 role.
• An explicit deny in the endpoint policy can block requests even when the EC2 role allows them.
• An S3 bucket policy can restrict access to requests that use a particular VPC endpoint using the aws:sourceVpce condition key.
• Gateway endpoints do not require a NAT gateway, public IPv4 addresses, or elastic network interfaces in the workload subnets.
• The endpoint is Regional; workloads must use the appropriate Regional S3 endpoint and AWS networking configuration.

Architecture Decision Guide

Requirement	Recommended approach	Reason
Private S3 access from EC2 instances in a VPC	S3 gateway endpoint	No NAT gateway required; route-table based and generally cost-effective
Private DynamoDB access from a VPC	DynamoDB gateway endpoint	Uses the same gateway endpoint model
Access to AWS services that do not support gateway endpoints	Interface VPC endpoint	Uses PrivateLink elastic network interfaces
Restrict S3 access to selected buckets or actions	Endpoint policy plus IAM and bucket policies	Applies layered least-privilege controls
Ensure a subnet uses the S3 endpoint	Associate its route table with the endpoint	Endpoint creation alone does not alter every route table
Prevent access through an approved endpoint	S3 bucket policy with aws:sourceVpce conditions	Enforces the expected VPC endpoint path
Private subnet access to S3 without NAT	S3 gateway endpoint	Removes the NAT dependency for S3 traffic

Common Exam Traps

• Assuming endpoint creation automatically covers the VPC: Gateway endpoints affect only associated route tables.
• Assuming only private subnets can use a gateway endpoint: Public-subnet route tables can be associated as well.
• Confusing gateway and interface endpoints: Gateway endpoints use route tables and prefix lists; interface endpoints use ENIs and security groups.
• Forgetting policy evaluation: An instance role allowing s3:ListAllMyBuckets does not overcome an explicit deny in the endpoint policy or bucket policy.
• Choosing NAT for all private AWS service traffic: An S3 gateway endpoint can eliminate NAT requirements for S3 specifically.
• Expecting a visible endpoint ENI for S3: Gateway endpoints do not create ENIs in your subnets.
• Treating a successful aws s3 ls as proof that the endpoint is being used: If the route table is not associated, the request may be using an internet gateway or NAT path.
• Ignoring route precedence and association: The correct route must exist in the route table actually used by the source subnet.
• Using broad default policies in production: A default allow-all endpoint policy is convenient for a lab but usually fails least-privilege requirements.

Real-World Engineer Notes

• Associate the endpoint with every route table whose subnets require S3 access, including separate route tables across Availability Zones when applicable.
• Use endpoint policies to limit the permitted S3 actions and resources, then use bucket policies for resource-level enforcement.
• A bucket policy can require access through a specific endpoint, but be careful not to lock out administrative or recovery workflows that use another path.
• Review VPC Flow Logs, CloudTrail data events, IAM policy evaluation, and S3 access logs where available when troubleshooting.
• A public IP on the EC2 instance is not required for traffic that matches the gateway endpoint route. However, public IP assignment may still be needed for unrelated internet access from a public subnet.
• Deleting a VPC can fail while instances, network interfaces, gateways, endpoints, or other dependent resources still exist. Clean up dependencies before removing the VPC.
• Test both connectivity and authorization. A network path can be available while IAM, endpoint, or bucket policy evaluation still denies the request.

Quick Reference Summary

• Supported gateway endpoint services: Amazon S3 and DynamoDB.
• Routing mechanism: Route table entry to an AWS-managed service prefix list with the VPC endpoint as target.
• Endpoint scope: Selected route tables, not automatically the entire VPC.
• NAT requirement for S3: Not required when the S3 gateway endpoint route is used.
• Primary security controls: IAM policies, endpoint policies, and S3 bucket policies.
• Explicit deny: Overrides an allow.
• S3 gateway endpoint implementation: No subnet ENIs; no endpoint security group.
• Verification principle: Change the endpoint policy or route-table association and observe whether request behavior changes.

Flashcards

1. Which AWS services support gateway VPC endpoints?

Amazon S3 and Amazon DynamoDB.

2. What does an S3 gateway endpoint add to a route table?

A route whose destination is an AWS-managed S3 prefix list and whose target is the VPC endpoint ID.

3. Does creating a gateway endpoint automatically apply it to all subnets?

No. The endpoint must be associated with the route tables used by the relevant subnets.

4. Do S3 gateway endpoints create elastic network interfaces?

No. They use route-table entries rather than ENIs.

5. Is a NAT gateway required for private-subnet access to S3 through a gateway endpoint?

No.

6. Can a public subnet use an S3 gateway endpoint?

Yes. Associate the public subnet’s route table with the endpoint.

7. What happens when the endpoint policy contains an explicit deny?

Requests routed through the endpoint are denied even if the IAM role allows the requested action.

8. Which IAM principal normally provides permissions to an EC2 instance?

An IAM role attached through an instance profile.

9. What does an EC2 role trust policy control?

Whether EC2 is allowed to assume the role and obtain temporary credentials.

10. What is the main implementation difference between gateway and interface endpoints?

Gateway endpoints use route tables and prefix lists; interface endpoints use PrivateLink ENIs in subnets.

11. How can an S3 bucket policy require use of a specific VPC endpoint?

Use a condition involving the aws:sourceVpce global condition key.

12. Why might an S3 request succeed even when an endpoint policy denies access?

The source subnet may not use a route table associated with the endpoint, so traffic may follow an internet gateway or NAT path instead.

Practice Questions

Question 1

An EC2 instance in a private subnet must access Amazon S3 without using a NAT gateway. The solution must minimize operational overhead and avoid endpoint network interfaces. What should an architect configure?

Correct answer: Create an S3 gateway VPC endpoint and associate it with the private subnet’s route table.

Explanation: S3 gateway endpoints use route-table entries and AWS-managed prefix lists. They do not require a NAT gateway or ENIs. The route-table association is mandatory.

Question 2

An EC2 instance has an IAM role permitting s3:ListAllMyBuckets. The instance can access S3 before a configuration change, but receives AccessDenied afterward. The endpoint policy was changed from allow to deny, and the instance’s route table is associated with the endpoint. What caused the failure?

Correct answer: The endpoint policy’s explicit deny overrides the permission in the EC2 role.

Explanation: IAM permissions and endpoint policies are evaluated together. An explicit deny takes precedence over an allow, so the role cannot authorize the request by itself.

Question 3

A gateway endpoint for S3 exists in a VPC. An EC2 instance in a public subnet continues to access S3 successfully even though the endpoint policy denies all actions. The endpoint is associated only with the private-subnet route tables. What is the most likely explanation?

Correct answer: The public subnet’s route table is not associated with the endpoint, so the request is using another path, such as the internet gateway.

Explanation: Gateway endpoint behavior is controlled by route-table association. To force the public subnet’s S3 traffic through the endpoint, associate its route table with the endpoint and apply the desired policy.

Question 4

A security team wants to ensure that a specific S3 bucket can be accessed only through an approved VPC endpoint. Which control should provide the resource-level enforcement?

Correct answer: Add an S3 bucket policy using the aws:sourceVpce condition key, with an explicit deny or appropriately scoped allow.

Explanation: The bucket policy evaluates the request at the S3 resource level and can restrict requests based on the VPC endpoint used. IAM and endpoint policies should still be configured consistently.

Question 5

An architect needs private connectivity from a VPC to an AWS service that does not support gateway endpoints. The design should use private IP addresses in selected subnets and security groups to control access. Which endpoint type is appropriate?

Correct answer: An interface VPC endpoint.

Explanation: Interface endpoints use AWS PrivateLink and create elastic network interfaces in selected subnets. Security groups can control traffic to those endpoint ENIs. Gateway endpoints are limited to S3 and DynamoDB.