VPC Endpoint for Amazon S3: Simple Connectivity From AWS

Let’s discuss VPC Endpoint’s value, common use cases, and how to get it up and running with the AWS CLI.

Last month Amazon Web Services introduced VPC Endpoint for Amazon S3. In this article, I am going to explain exactly what this means, how it will change – and improve – the way AWS resources communicate with each other, and how you can get it running with the AWS CLI.

Not that it’s quite complete yet, mind you:

Currently, we support endpoints for connections with Amazon S3 within the same region only. We’ll add support for other AWS services later.

Accessing S3 the old way (without VPC Endpoint)

Traditionally, when creating a VPC with a private subnet you would set up security groups and access control lists (ACLs) to control inbound and outbound traffic. Because this is a private subnet, by default it has no access to any outside public resources. Consequently, should you need access to an outside resource, you would need to set up an Internet Gateway and route traffic through a NAT instance.

So, for example, if your EC2 instance runs an application that needs access to a file stored in an S3 bucket, before VPC Endpoint, this illustrates the only way it could be done:

VPC Endpoint: A private subnet with the main route table set up
A private subnet with the main route table set up

Accessing S3 with VPC Endpoint

Now, however, accessing S3 resources from within a private VPC subnet is much simpler. There’s no longer any need to configure a gateway or NAT instances. And as an added bonus, these endpoints are easy to set up, highly reliable, and provide a secure connection to S3.

VPC Endpoint for Amazon S3
With VPC Endpoint for Amazon S3, accessing buckets is a much simpler process

If you’d prefer to work with the console to create a VPC Endpoint, you can easily follow the clear directions from the official AWS Blog. However, I am going to show you how to do it using the AWS CLI.  (By the way, Cloud Academy has a great course guiding you through the AWS CLI if you could use some help).

Creating and Using VPC Endpoints with the AWS CLI

When we create our VPC endpoint we will use the following commands

  1. describe-route-tables (Get our VPC Id and route table for the endpoint)
  2. create-vpc-endpoint (Create your VPC endpoint)
  3. describe-vpc-endpoints (List your VPC endpoint)
  4. delete-vpc-endpoints (Delete a VPC endpoint)

So first, get our VPC ID and route table ID to use for the endpoint

$ aws ec2 describe-route-tables

Your output should look something like this:

--------------------------------------------------------------------------------------------------------
|                                          DescribeRouteTables                                         |
+------------------------------------------------------------------------------------------------------+
||                                             RouteTables                                            ||
|+-------------------------------------------------+--------------------------------------------------+|
||  RouteTableId                                   |  rtb-0404a561                                    ||
||  VpcId                                          |  vpc-731e0711                                    ||
|+-------------------------------------------------+--------------------------------------------------+|
|||                                           Associations                                           |||
||+------------------------------------------------------+-------------------------------------------+||
|||  Main                                                |  False                                    |||
|||  RouteTableAssociationId                             |  rtbassoc-a4339dc1                        |||
|||  RouteTableId                                        |  rtb-0404a561                             |||
|||  SubnetId                                            |  subnet-fcbb5b99                          |||
||+------------------------------------------------------+-------------------------------------------+||
|||                                              Routes                                              |||
||+-----------------------------------------------------+--------------------------------------------+||
|||  DestinationCidrBlock                               |  172.31.0.0/16                             |||
|||  GatewayId                                          |  local                                     |||
|||  Origin                                             |  CreateRouteTable                          |||
|||  State                                              |  active                                    |||
||+-----------------------------------------------------+--------------------------------------------+||
|||                                               Tags                                               |||
||+---------------------------------+----------------------------------------------------------------+||
|||  Key                            |  Name                                                          |||
|||  Value                          |  endpointroute                                                 |||
||+---------------------------------+----------------------------------------------------------------+||
||                                             RouteTables                                            ||
|+-------------------------------------------------+--------------------------------------------------+|
||  RouteTableId                                   |  rtb-b1849cd3                                    ||
||  VpcId                                          |  vpc-731e0711                                    ||
|+-------------------------------------------------+--------------------------------------------------+|
|||                                           Associations                                           |||
||+------------------------------------------------------+-------------------------------------------+||
|||  Main                                                |  True                                     |||
|||  RouteTableAssociationId                             |  rtbassoc-9f0f14fd                        |||
|||  RouteTableId                                        |  rtb-b1849cd3                             |||
||+------------------------------------------------------+-------------------------------------------+||
|||                                              Routes                                              |||
||+----------------------+---------------------------+----------------+-------------------+----------+||
||| DestinationCidrBlock |  DestinationPrefixListId  |   GatewayId    |      Origin       |  State   |||
||+----------------------+---------------------------+----------------+-------------------+----------+||
|||  172.31.0.0/16       |                           |  local         |  CreateRouteTable |  active  |||
|||  0.0.0.0/0           |                           |  igw-1b312779  |  CreateRoute      |  active  |||
|||                      |  pl-6ca54005              |  vpce-d7b652be |  CreateRoute      |  active  |||
||+----------------------+---------------------------+----------------+-------------------+----------+||

This tells me that my VPC ID is vpc-731e0711, and my Route Table Id  (the one connected to a subnet) is rtb-0404a561.
Now let’s create a VPC endpoint. Remember that AWS currently supports endpoints within a single region, so we should note that my default region is  ap-southeast-2.

$ aws ec2 create-vpc-endpoint --vpc-id vpc-731e0711 --service-name com.amazonaws.ap-southeast-2.s3 --route-table-ids rtb-0404a561

Here’s my output:

-------------------------------------------------------------------------------------------------------------------------------------------
|                                                            CreateVpcEndpoint                                                            |
+-----------------------------------------------------------------------------------------------------------------------------------------+
||                                                              VpcEndpoint                                                              ||
|+-------------------+-------------------------------------------------------------------------------------------------------------------+|
||  CreationTimestamp|  2015-06-04T02:45:52Z                                                                                             ||
||  PolicyDocument   |  {"Version":"2008-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":"*","Action":"*","Resource":"*"}]}   ||
||  ServiceName      |  com.amazonaws.ap-southeast-2.s3                                                                                  ||
||  State            |  available                                                                                                        ||
||  VpcEndpointId    |  vpce-97b652fe                                                                                                    ||
||  VpcId            |  vpc-731e0711                                                                                                     ||
|+-------------------+-------------------------------------------------------------------------------------------------------------------+|
|||                                                            RouteTableIds                                                            |||
||+-------------------------------------------------------------------------------------------------------------------------------------+||
|||  rtb-0404a561                                                                                                                       |||
||+-------------------------------------------------------------------------------------------------------------------------------------+||

You should now have a VpcEndpoint connecting your VPC to an Amazon S3 service in the region you chose. You can now list your VpcEndpoint and the output should be similar to what you got above – unless you created more than one VpcEndpoint:

$ aws ec2 describe-vpc-endpoints

Finally, if you don’t plan on using this again, you can delete the VpcEndpoint using the following:

$ aws ec2 delete-vpc-endpoints --vpc-endpoint-ids vpce-97b652fe

What does all this now mean?

Even once you create a VPC Endpoint, the S3 public endpoints and DNS names will continue to work as they always have. All that the EndPoint does is add a new way by which the requests are routed from your private subnet to S3. Remember also that endpoints are virtual devices: they are horizontally scaled, redundant, and highly available VPC components that allow low-risk communication between instances in your VPC and AWS services.

What an endpoint effectively does is enable instances in your VPC to use their private IP addresses to communicate with resources in other services. Consequently, your instances do not require public IP addresses, and you do not need an Internet Gateway, a NAT instance, or a virtual private gateway in your VPC. This is because you use endpoint policies to control access to resources in other services. Traffic between your VPC and the AWS service does not leave the Amazon network.

Best of all, there is no additional charge for using endpoints. You will, of course, be charged standard charges for data transfer and resource use.

Avatar

Written by

Michael Sheehy

I have been UNIX/Linux System Administrator for the past 15 years and am slowly moving those skills into the AWS Cloud arena. I am passionate about AWS and Cloud Technologies and the exciting future that it promises to bring.


Related Posts

Joe Nemer
Joe Nemer
— September 15, 2020

New Content: Azure DP-100 Certification, Alibaba Cloud Certified Associate Prep, 13 Security Labs, and Much More

This past month our Content Team served up a heaping spoonful of new and updated content. Not only did our experts release the brand new Azure DP-100 Certification Learning Path, but they also created 18 new hands-on labs — and so much more! New content on Cloud Academy At any time, y...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— August 28, 2020

AWS Certification Practice Exam: What to Expect from Test Questions

If you’re building applications on the AWS cloud or looking to get started in cloud computing, certification is a way to build deep knowledge in key services unique to the AWS platform. AWS currently offers 12 certifications that cover major cloud roles including Solutions Architect, De...

Read more
  • AWS
  • AWS Certifications
Patrick Navarro
Patrick Navarro
— August 25, 2020

Overcoming Unprecedented Business Challenges with AWS

From auto-scaling applications with high availability to video conferencing that’s used by everyone, every day —  cloud technology has never been more popular or in-demand. But what does this mean for experienced cloud professionals and the challenges they face as they carve out a new p...

Read more
  • AWS
  • Cloud Adoption
  • digital transformation
Avatar
Andrew Larkin
— August 18, 2020

Constant Content: Cloud Academy’s Q3 2020 Roadmap

Hello —  Andy Larkin here, VP of Content at Cloud Academy. I am pleased to release our roadmap for the next three months of 2020 — August through October. Let me walk you through the content we have planned for you and how this content can help you gain skills, get certified, and...

Read more
  • alibaba
  • AWS
  • Azure
  • content roadmap
  • Content updates
  • DevOps
  • GCP
  • Google Cloud
  • New content
Alisha Reyes
Alisha Reyes
— August 5, 2020

New Content: Alibaba, Azure AZ-303 and AZ-304, Site Reliability Engineering (SRE) Foundation, Python 3 Programming, 16 Hands-on Labs, and Much More

This month our Content Team did an amazing job at publishing and updating a ton of new content. Not only did our experts release the brand new AZ-303 and AZ-304 Certification Learning Paths, but they also created 16 new hands-on labs — and so much more! New content on Cloud Academy At...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Alisha Reyes
Alisha Reyes
— July 16, 2020

Blog Digest: Which Certifications Should I Get?, The 12 Microsoft Azure Certifications, 6 Ways to Prevent a Data Breach, and More

This month, we were excited to announce that Cloud Academy was recognized in the G2 Summer 2020 reports! These reports highlight the top-rated solutions in the industry, as chosen by the source that matters most: customers. We're grateful to have been nominated as a High Performer in se...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs
Avatar
Cloud Academy Team
— July 9, 2020

Which Certifications Should I Get?

The old AWS slogan, “Cloud is the new normal” is indeed a reality today. Really, cloud has been the new normal for a while now and getting credentials has become an increasingly effective way to quickly showcase your abilities to recruiters and companies. With all that in mind, the s...

Read more
  • AWS
  • Azure
  • Certifications
  • Cloud Computing
  • Google Cloud Platform
Alisha Reyes
Alisha Reyes
— July 2, 2020

New Content: AWS, Azure, Typescript, Java, Docker, 13 New Labs, and Much More

This month, our Content Team released a whopping 13 new labs in real cloud environments! If you haven't tried out our labs, you might not understand why we think that number is so impressive. Our labs are not “simulated” experiences — they are real cloud environments using accounts on A...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— June 19, 2020

Kickstart Your Tech Training With a Free Week on Cloud Academy

Are you looking to make a jump in your technical career? Want to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Kubernetes, Python, or another in-demand skill? Then you'll want to mark your calendar. Starting Monday, June 22 at 12:00 a.m. PDT (3:00 a.m. EDT), ...

Read more
  • AWS
  • Azure
  • cloud academy content
  • complimentary access
  • GCP
  • on the house
Alisha Reyes
Alisha Reyes
— June 11, 2020

New Content: AZ-500 and AZ-400 Updates, 3 Google Professional Exam Preps, Practical ML Learning Path, C# Programming, and More

This month, our Content Team released tons of new content and labs in real cloud environments. Not only that, but we introduced our very first highly interactive "Office Hours" webinar. This webinar, Acing the AWS Solutions Architect Associate Certification, started with a quick overvie...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Rebecca Willis
Rebecca Willis
— June 3, 2020

Azure vs. AWS: Which Certification Provides the Brighter Future?

More and more companies are using cloud services, prompting more and more people to switch their current IT position to something cloud-related. The problem is most people only have that much time after work to learn new technologies, and there are plenty of cloud services that you can ...

Read more
  • AWS
  • Azure
  • certification
Alisha Reyes
Alisha Reyes
— June 2, 2020

Blog Digest: 5 Reasons to Get AWS Certified, OWASP Top 10, Getting Started with VPCs, Top 10 Soft Skills, and More

Thank you for being a valued member of our community! We recently sent out a short survey to understand what type of content you would like us to add to Cloud Academy, and we want to thank everyone who gave us their input. If you would like to complete the survey, it's not too late. It ...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs