如何通过Direct Connect强制仅私有连接访问S3 Bucket？

方案一：基于源IP的Bucket Policy限制 #

通过在Bucket Policy中指定允许访问的Direct Connect关联的公网IP前缀，拒绝所有其他来源的访问。示例Policy如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "x.x.x.x/xx",  // 替换为你的Direct Connect公网IP前缀
            "y.y.y.y/xx"
          ]
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ],
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": [
            "x.x.x.x/xx",
            "y.y.y.y/xx"
          ]
        }
      }
    }
  ]
}

注意：需要提前确认你的Direct Connect连接对应的公网IP范围，可通过AWS控制台或aws directconnect describe-connections命令获取。

方案二：通过VPC端点+私有虚拟接口实现私有访问 #

1. 在与Direct Connect私有虚拟接口关联的VPC中创建S3网关端点（针对S3访问，网关端点更常用且免费）。
2. 配置Bucket Policy，仅允许通过该VPC端点发起的请求访问：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:sourceVpce": "vpce-xxxxxxxxx"  // 替换为你的S3 VPC端点ID
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:sourceVpce": "vpce-xxxxxxxxx"
        }
      }
    }
  ]
}

这种方式的优势是流量完全走AWS私有网络，不经过公网，安全性更高，也无需依赖公网IP范围。

额外注意事项 #

• 确保Bucket的其他权限（如IAM用户/角色权限）不会覆盖上述Bucket Policy的限制，建议遵循最小权限原则。
• 测试时可通过Direct Connect连接内的主机访问S3，同时尝试从外部公网访问验证是否被拒绝。

内容的提问来源于stack exchange，提问作者Paolo