Connect Privately to Amazon S3 with a VPC Gateway Endpoint

Most teams assume that "Private" S3 access means PrivateLink interface endpoints, but Amazon S3 offers a second, distinctly different door: the gateway endpoint. Gateway endpoints are free, route-table-based connections that exist only for S3 and DynamoDB. Instead of placing an Elastic Network Interface inside your subnet, a gateway endpoint installs a managed prefix list entry into your route table so that any traffic destined for S3 in the current region is silently redirected through the AWS backbone, never touching the public internet, never traversing a NAT gateway, and never costing a cent in data processing charges.

A gateway endpoint can be paired with two complementary policies which restricts which buckets, principals, and actions are permitted through that endpoint, and uses the aws:SourceVpce condition to deny any request that did not arrive via your specific VPC endpoint. Together they turn an open S3 bucket into one that simply does not exist for anyone outside your VPC.

In this lab, you will provision an EC2 instance inside a fully isolated subnet (no IGW, no NAT), prove that S3 is unreachable, create an S3 gateway endpoint, watch the prefix list route appear, confirm connectivity through the endpoint, then progressively tighten access using both an endpoint policy and a bucket-side aws:SourceVpce condition.

Note: This lab's environment (isolated VPC, EC2 Instance Connect Endpoint, and test host) takes about 5 minutes to provision before the lab is ready to start. If you're short on time, look for a lab with a lighter pre-provisioned environment instead.

Objectives

Upon completion of this intermediate level lab, you will be able to:

• Connect to an EC2 instance in an isolated subnet using EC2 Instance Connect Endpoint and confirm S3 is unreachable without a private path.
• Create an S3 gateway VPC endpoint and attach it to the lab VPC's route table.
• Inspect the auto-generated pl-* managed prefix list route and re-test S3 connectivity over the private path.
• Apply a VPC endpoint policy that restricts S3 access to one allow-listed bucket.
• Apply a bucket policy with an aws:SourceVpce condition to deny all access that does not originate from the gateway endpoint.

Who is this lab for?

This lab is designed for:

• AWS engineers preparing for the SAA-C03 Solutions Architect Associate certification.
• Security-focused practitioners hardening data egress paths and retiring NAT gateways.
• Platform teams who want to lock S3 buckets so they are reachable only from a specific VPC.