S3 sirf VPC ke andar se: endpoint-locked bucket

Pehle do buckets bante hain: deepdive-vault-... (salary wali) aur deepdive-other-... (tulna ke liye). Vault mein ek salary file upload hoti hai.

Phir default VPC aur uski main route table ka ID nikaala jaata hai, aur S3 ka gateway endpoint banake us route table se joda jaata hai.

EC2 role ke paas S3 padhne ki permission pehle se hai (Lab 1 ki S3ReadOnly). Ab use dono buckets mein likhne ki inline permission bhi di jaati hai.

Aakhir mein bina kisi inbound rule wala ek SG banta hai, aur usme finance-app naam ka EC2 default VPC mein launch hota hai.

export AWS_DEFAULT_REGION=us-east-1 TYPE=t3.micro
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
mkdir -p ~/deepdive/scn7 && cd ~/deepdive/scn7
VAULT=deepdive-vault-$ACCOUNT_ID ; OTHER=deepdive-other-$ACCOUNT_ID
aws s3 mb s3://$VAULT && aws s3 mb s3://$OTHER
echo "CFO salary: top secret" > salary.txt && aws s3 cp salary.txt s3://$VAULT/salary.txt

VPC=$(aws ec2 describe-vpcs --filters Name=isDefault,Values=true --query 'Vpcs[0].VpcId' --output text)
MAIN_RT=$(aws ec2 describe-route-tables --filters Name=vpc-id,Values=$VPC Name=association.main,Values=true --query 'RouteTables[0].RouteTableId' --output text)
VPCE=$(aws ec2 create-vpc-endpoint --vpc-id $VPC --service-name com.amazonaws.us-east-1.s3 \
  --vpc-endpoint-type Gateway --route-table-ids $MAIN_RT --query VpcEndpoint.VpcEndpointId --output text); echo $VPCE

# EC2 role ko vault pe write bhi chahiye (read S3ReadOnly se already hai)
cat > vault-write.json <<EOF
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":["arn:aws:s3:::$VAULT/*","arn:aws:s3:::$OTHER/*"]}]}
EOF
aws iam put-role-policy --role-name deepdive-ec2-role --policy-name scn7-vault-write --policy-document file://vault-write.json

AMI_ID=$(aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text)
SG=$(aws ec2 create-security-group --vpc-id $VPC --group-name scn7-no-inbound --description "no inbound" --query GroupId --output text)
IID=$(aws ec2 run-instances --image-id $AMI_ID --instance-type $TYPE --security-group-ids $SG \
  --iam-instance-profile Name=deepdive-ec2-role --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=finance-app}]' \
  --query 'Instances[0].InstanceId' --output text)

Default VPC ke subnets main route table use karte hain, isliye endpoint ko usi route table se joda gaya.

PL-065 course se — asli console reference

Bucket create aur EC2 launch ka wahi console — endpoint aur endpoint-policy course mein cover nahi hui, wahan self kholna.

Yeh block vault bucket pe ek Deny policy lagata hai. Isme do conditions hain. Pehli condition kehti hai ki request hamare endpoint se nahi aayi. Doosri condition kehti hai ki request karne wala na toh deepdive-admin hai aur na hi root. Dono conditions sach hone pe hi request deny hogi, yaani endpoint ke bahar se aayi har request deny hogi, sivaaye admin aur root ki requests ke. Policy lagane ke baad tum admin ke roop mein bucket list karke check karte ho ki tumhara access bana hua hai.

cat > vault-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnlessFromOurVpcEndpoint",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::$VAULT", "arn:aws:s3:::$VAULT/*"],
      "Condition": {
        "StringNotEquals": { "aws:SourceVpce": "$VPCE" },
        "ArnNotLike": { "aws:PrincipalArn": [
          "arn:aws:iam::$ACCOUNT_ID:user/deepdive-admin",
          "arn:aws:iam::$ACCOUNT_ID:root"
        ] }
      }
    }
  ]
}
EOF
aws s3api put-bucket-policy --bucket $VAULT --policy file://vault-policy.json
aws s3 ls s3://$VAULT          # admin (tum) — abhi bhi chalega ✔

Yeh block endpoint pe ek policy lagata hai jo is endpoint ke through sirf deepdive- se shuru hone wale buckets tak access deti hai. Isse VPC ke andar se kisi bahari bucket mein data bhejna ya usse data lena band ho jaata hai.

cat > endpoint-policy.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "OnlyOurBuckets",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::deepdive-*", "arn:aws:s3:::deepdive-*/*"]
    }
  ]
}
EOF
aws ec2 modify-vpc-endpoint --vpc-endpoint-id $VPCE --policy-document file://endpoint-policy.json

Dhyan do ki ab default VPC ke saare instances S3 mein sirf deepdive-* buckets tak pahunch paayenge. AL2023 ke dnf repos S3 pe nahi hain, isliye package install karne pe asar nahi padna chahiye. Lekin asli VPCs mein aisi policy lagane se pehle dependencies zaroor check karo. Cleanup mein yeh endpoint delete ho jaayega.