S3 access works from a laptop but fails from a VM using a VPC endpoint

The same intended role can read an object from an approved diagnostic session, while a service running through an S3 VPC endpoint receives 403. The team has checked the role and bucket policy but has not reviewed the endpoint policy. How should the differing request paths be compared?

First confirm that both tests really use the same principal and operation. Then examine controls specific to the VM’s path, including the VPC endpoint policy and policy conditions related to the source network. A matching role policy does not eliminate a deny enforced elsewhere.

AWS notes limitations in enhanced denial context for endpoint-policy failures. Treat a generic error as incomplete evidence, not proof that the endpoint is uninvolved. Review the intended endpoint boundary and test a narrowly authorized correction rather than routing production traffic around a required control.

If the role has an allow, can another allow override the endpoint deny?

An explicit deny is not cancelled by adding an allow. Locate and review the denying statement in the applicable policy context.

Compare region, access-point use and resource ARN as well. Tests that look equivalent in a short description can actually call different endpoints or resources.

S3 access works from a laptop but fails from a VM using a VPC endpoint

Sources & further reading

2 answers

Your perspective belongs here.

0 question comments