I have a server with the following route table on its subnet:

10.xxx.xxx.xxx/24 -- local
pl-xxxxxxxxxx(com.amazonaws.us-east-1.s3) -- vpce-xxxxxxx -- vgw-xxxxxxxx -- vgw-xxxxxxxx

The S3 VPC Endpoint (vpce-xxxxxx) above has a "Full Access" S3 policy attached to it. However, I am still unable to access S3 from within my server without routing through the public Internet (by proxy).

How can I troubleshoot this problem?


The problem was that my server's security group did not have an outbound rule for the S3 bucket. I added an HTTPS outbound rule with the "custom IP" field pointed to "pl-xxxxxxxxxx" (from question).

| improve this answer | |
  • 1
    If you have whitelisted one or more IPs for S3, this is likely to break over time, because there are many IP addresses for S3. Perhaps in the future AWS help solve the problem by allowing Security Group rules to simply refer to "S3" abstractly, without managing the large and changing list of IP addresses. – Mark Stosberg Jan 13 '16 at 20:59
  • 2
    @MarkStosberg actually, not true: AWS has solved the issue you raise: the pl-xxxxxxxx identifier represents a list of IP subnets (pl = prefix list) that's maintained by AWS and includes all IPs assigned to S3 within the region. It is created when you set up an S3 endpoint in a VPC can be used in an outgoing security group to permit access to S3. It doesn't have to be maintained by the customer when S3 addresses change since it's automatically updated. This setup also relieves NAT instances and gateways of S3 traffic from private subnets, by modifying VPC route tables. – Michael - sqlbot Jan 14 '16 at 3:07
  • 1
    @Michael-sqlbot awesome to know! I missed that news. – Mark Stosberg Jan 14 '16 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.