S3 access works from a laptop but fails from a VM using a VPC endpoint

0 reputation · 03 Dec 2024, 01:15 UTC

107.5K views2

The same intended role can read an object from an approved diagnostic session, while a service running through an S3 VPC endpoint receives 403. The team has checked the role and bucket policy but has not reviewed the endpoint policy. How should the differing request paths be compared?

Environment

Editorial worked example. See the question for the scenario and assumptions.

2,780 following

Keep exploring this topic

S3 object downloads work, but listing the bucket returns AccessDenied

An example service can retrieve a known object key but cannot enumerate the same bucket. The role policy was written specifically for object reads, and the application recently added a directory-style browser. Does successful GetObject access imply that the list request should also work?

One S3 object returns 403 while others in the same prefix download correctly

A fictional application reads most objects under an allowed prefix. A newer object returns AccessDenied. The newer object uses a different customer-managed KMS key. The bucket policy appears unchanged. Which evidence would distinguish S3 access from encryption-key access?

Why does an EC2 service use the wrong AWS identity after an instance role is attached?

In this example, a team attaches the intended instance profile to EC2. A diagnostic command in a clean shell shows the expected role, but the application still identifies itself as an older IAM user. The system service definition contains legacy AWS environment variables. What should change?

IAM Roles Anywhere Test Credentials Issued Against Production Trust Anchor

Integration tests may reuse production IAM Roles Anywhere trust anchors; unclear whether separate certificate authorities and profiles are required for non-production isolation.

First confirm that both tests really use the same principal and operation. Then examine controls specific to the VM’s path, including the VPC endpoint policy and policy conditions related to the source network. A matching role policy does not eliminate a deny enforced elsewhere.

AWS notes limitations in enhanced denial context for endpoint-policy failures. Treat a generic error as incomplete evidence, not proof that the endpoint is uninvolved. Review the intended endpoint boundary and test a narrowly authorized correction rather than routing production traffic around a required control.

S3 access works from a laptop but fails from a VM using a VPC endpoint

2 answers

Your perspective belongs here.

0 question comments