Cross account S3 static website access over VPN only

MOps 0
Viewed 52

I'm trying to allow access to s3 bucket static website over VPN from network aws account , bucket in prod account.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": "account-prod",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpc": "vpc-1"
                }
            }
        }
       {
            "Sid": "",
            "Effect": "Allow",
            "Principal": "account-network",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpc": "vpc-2"  <<<>>> tried SourceVpce as well           
                }
            }
        }
    ]
}

I used VPC endpoint interface in the account where VPN is setup , I tried using Condition SourceVpc and SourceVpce but non worked.

I'm using transit gateway and aws client vpn and allowed s3 endpoint IPs on the vpn endpoint + SGs + auth rules. (tgw is used and s3 prefix list, route entry from s3 prefix list via tgw)

bucket uses object owner + private ACL + bucket policy and I tried adding grantee with the canonical account id.

Any ideas what am I doing wrong here ?

This currently works in the prod account as we have another VPN solution that runs there, we are trying to migrate everything to network account and move to aws client vpn.

aws-vpn amazon-s3 amazon-web-services
2 Answers

Any ideas what am I doing wrong here ?

Yes. s3 bucket static website can only be accesses over the Internet. You can't access them using private IP addresses from VPC or VPN. If you use VPN, you have to setup some proxy which will access the website using the internet, and then pass it back to your host.

userTK210
Thom-AwS0
Related