Instructor: So here is a short theory lecture.
But it is important for you to understand
how the VPC Endpoint Gateways work for Amazon S3.
So by default, an S3 Bucket lives on the
AWS cloud, okay?
But to access it,
you need to go through the public internet.
So that means that's your instance launch
in a public sublet, for example,
will access through the internet gateway
the public endpoints of your S3 Bucket
and the files go that way.
That means that your S3 Bucket can have a Bucket policy
and you can filter by either AWS-SourceIP
to be a public IP of your institute instance, okay?
Now, if you wanted to have a private access
to you S3 Bucket,
so you don't want the traffic to go through
the public internet,
then you deploy your instances reasonable
in a private subnets, and you would create a
VPC Endpoint Gateway.
So this VPC Endpoint Gateway allows you to establish
a private connection from your instance directly
into the S3 Bucket.
And this allows you to create different bucket policies.
So this one, the bucket policy you can apply,
to force access only through a VPC Endpoint Gateway
is to use a Bucket policy by AWS-SourceVpce.
And you can specify one or a few end points,
or you can specify a bucket policy and specify
AWS-SourceVPC condition to encompass
all possible VPC endpoints within a predefined VPC.
So that's it, just for it to show you
the two different ways.
And obviously the VPC Endpoint Gateway
is going to be preferred for security
and also I think for cost reasons.
So that's it for this lecture, I hope you liked it.
And I will see you in the next lecture.