In an AWS Organization, we have multiple accounts, each account having its own S3 buckets. Some buckets are required to support cross-account sharing.
It is possible to write an endpoint policy that ensures access to all these buckets from a given VPC goes through an endpoint in that VPC.
- I believe this does not address access via pre-signed URLs, which I also want to prevent
- Assuming that a bucket policy is further required to ensure access originates from within the organization, how do I write a bucket policy that ensures access to that bucket can only originate from one of the organization's VPCEs? Can I reference another account's VPCE in the
sourceVpcecondition (and multiple of those)? With VPCEs in the picture, IP address restrictions are out of question.