In an AWS Organization, we have multiple accounts, each account having its own S3 buckets. Some buckets are required to support cross-account sharing.

It is possible to write an endpoint policy that ensures access to all these buckets from a given VPC goes through an endpoint in that VPC.

  1. I believe this does not address access via pre-signed URLs, which I also want to prevent
  2. Assuming that a bucket policy is further required to ensure access originates from within the organization, how do I write a bucket policy that ensures access to that bucket can only originate from one of the organization's VPCEs? Can I reference another account's VPCE in the sourceVpce condition (and multiple of those)? With VPCEs in the picture, IP address restrictions are out of question.


  • FWIW, I tried adding a condition to prevent access unless access originates from within organization, using aws:PrincipalOrgID but the pre-signed URL contains the access key and I presume the caller is still considered part of the organization – PerennialN00b Apr 9 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.