Simplifying S3 Access with an Interface VPC Endpoint and Route 53

Use Route 53 private hosted zones so clients can reach S3 through a VPC endpoint without --endpoint-url.

Takahiro Iwasa

2022-11-26

2 min read

The S3 interface VPC endpoint requires specifying the --endpoint-url option when accessing S3. However, to simplify access and avoid specifying this option repeatedly, Route 53 private hosted zones can be used.

S3 VPC Endpoint

Create an interface VPC endpoint with the following command:

aws ec2 create-vpc-endpoint \
  --vpc-id $YOUR_VPC_ID \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.$YOUR_REGION.s3 \
  --subnet-ids $YOUR_PRIVATE_SUBNET_IDS \
  --security-group-ids $YOUR_SECURITY_GROUP_IDS

Verify the creation of the endpoint and retrieve its DNS entries:

aws ec2 describe-vpc-endpoints \
  --filters Name=service-name,Values=com.amazonaws.$YOUR_REGION.s3 \
  --query "VpcEndpoints[*].DnsEntries"

1
[
2
  [
3
    {
4
      "DnsName": "*.vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx.s3.ap-northeast-1.vpce.amazonaws.com",
5
      "HostedZoneId": "xxxxxxxxxxxxxx"
6
    },
7
    {
8
      "DnsName": "*.vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx-ap-northeast-1a.s3.ap-northeast-1.vpce.amazonaws.com",
9
      "HostedZoneId": "xxxxxxxxxxxxxx"
10
    }
11
  ]
12
]

Confirm S3 access using the VPC endpoint’s URL:

❗ Important

The --region option must be specified.

aws s3 ls \
  --region <YOUR_REGION> \
  --endpoint-url http://vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx.s3.ap-northeast-1.vpce.amazonaws.com

Route 53 Private Hosted Zone

To simplify S3 access, create a Route 53 private hosted zone with the following command:

aws route53 create-hosted-zone \
  --name s3.$YOUR_REGION.amazonaws.com \
  --vpc VPCRegion=$YOUR_REGION,VPCId=$YOUR_VPC_ID \
  --caller-reference "$(date)"