Here you are.
And welcome back.
Now, in today's video, we'll be discussing about the VPC endpoint policies.
Now, at a high level overview, whenever you go ahead and create a VPC endpoint, let's assume a gateway
endpoint.
Then you can attach an endpoint policy to it that controls the access to the services that you are connecting
to.
For example, let's say that you have a VPC endpoint over here and the traffic to the three service
from the EC2 instance is directed from here.
Now within the S three, there are two buckets that are available.
You have a demo bucket and you have a CP Labs bucket.
Now by default, the EC two instance will be able to communicate with both of the buckets, considering
that it has its associated proper IAM role.
However, as an additional measure at a VPC endpoint level, also you can go ahead and control the traffic
to a specific S3 bucket.
So for example, you have an endpoint policy which says allow connection to demo bucket.
So if this endpoint policy is associated, then even though the SC two instance has a full SE three
permission, it will only be able to communicate to the demo bucket.
It will not be able to communicate to the CP Labs bucket, considering that the traffic is flowing through
the VPC endpoint and this is the basic idea behind the VPC endpoint policies.
So let's do one thing.
Let's go ahead and try this out practically to understand it in a better way.
Now, currently we have a gateway endpoint based on the S three service that is available.
Now, if you look into the policy over here, by default, the endpoint policy allows all the connection
to all the resources.
So this is one of the default policies.
However, if we need, we can go ahead and customize it as well.
So for today's demo for the region where our endpoint is created, which is us Twist two, I have two
is three buckets and based on these two three buckets, we'll go ahead and design our endpoint policies.
So before we go ahead and start to write our endpoint policies from our private EC2 instance, let's
go ahead and verify the connection to both of these three buckets.
Now, first, we'll go ahead and do a plus three ls on one of the buckets here, let's do an enter and
as expected, we are able to see the results.
And in a similar way we'll go ahead and connect to another S3 bucket within the same region.
Let's press enter and we are able to see the content.
So basically both of these three buckets has a similar file.
Now let's go ahead and design a policy where the VPC endpoint will only allow connection to the second
bucket from here, which is temp endpoint.
US two west two.
It should not allow connection to any other S3 buckets.
So now from the endpoint, let's go ahead and edit the policy.
Now there are multiple ways in which you can create a policy.
One of the easiest way is to use a policy creation tool.
So let's go ahead and open this up.
And within the policy creation tool, you can go ahead and easily select the basic context and the policy
will be created for you.
So the policy type would be the VPC endpoint principal.
Let's just put it as.
Now within the service, we'll just use S3 within the actions, we'll just use all actions.
And then you have to specify the admin now here and you can either directly write it or you can even
get it from the S3 console.
So if I go to properties, you'll basically can get the and let me paste there.
And once I add the statement, we can quickly generate the policy.
So this is the policy that is created.
Let me copy this up.
And within the policy I'll select custom and let's paste that policy.
So based on this policy, only the connection to this S3 bucket would be allowed.
Let's try it out.
So I'll just quickly do a save.
And as expected, now we see you have a custom policy now from our private EC2 instance, if we connect
to the temp endpoint US twist two.
So this is the S3 bucket that is allowed within the endpoint policy.
It is working perfectly well if we try to connect to temp endpoint two.
So this is our second S3 bucket and immediately you see you are getting an access denied on the operations
associated with this S3 bucket.
Great.
So I hope at a high level overview you understood the importance of the VPC endpoint policies and this
allows a great number of customization and the access control based on the requirement for your organization.
Now, a few important things that you should know when we discuss about the policy decision, specifically
at the VPC endpoint based architecture.
First important policy based decision comes from the IAM rule, which is associated with the EC2 instance,
or if you have access secret key, it is associated with a policy for those access secret key.
So this is the first step.
So only after the EC two instance is authorized, then the decision can be made, then the next important
decision.
Which can be allowed or denied is at the Gateway VPC endpoint level.
So we already have seen on how we can go ahead and create a resource level policy at a VPC endpoint
level.
And the third place where the policy decision can allow or can deny is at the S three level.
So you can go ahead and create an S3 bucket, which can also deny the connection.
So whenever you are going ahead and implementing a VPC endpoint based architecture and due to some reason
you are getting access denied, then these are the three primary places that you need to look into as
part of the troubleshooting step.
That's great.
So with this will conclude today's video.