Is there a way to make a private connection between a Heroku Private Space and AWS S3?

Heroku Private Spaces are connected to AWS S3 via AWS PrivateLink. As such, the connection to AWS S3 is private (not over the internet).

To whitelist a Heroku private space in an AWS S3 bucket policy, whitelist the Private Space's AWS VPC id. The VPC id can be found with the command heroku spaces:peering:info --space <your space's name>. Here is an example bucket policy:

{
    "Version": "2012-10-17",
    "Id": "example-policy",
    "Statement": [
        {
            "Sid": "AllowHerokuPrivateSpaceVpcAccess",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "*",
            "Resource": "arn:aws:s3:::example-bucket/*",
            "Condition": {
                "StringEquals": {
                    "aws:sourceVpc": "<your space's VPC id>"
                }
            }
        }
    ]
}

Requests to the bucket will be logged as coming from private IPs (e.g. 10.0.0.0/16).

Source: Heroku Support. This behavior is not documented in the Heroku documentation.