Download s3 presign url in private subnet have no internet connection

0

Hi I have a private subnet with an EC2 and a s3 bucket (same region). I have a lambda function that creates presign URL and response to EC2. I can download it with an internet connection, but when EC2 is disconnected from the internet, I can't. How can I achieve this in order to make user can download even if there is no internet? I had some ideas like a S3 access point or download by an API gateway or instead of returning presign URL, I can return blob or octet-stream. Can you guys guide me on this thing? Thanks

  • When you have a Private Subnet in a VPC (no internet connectivity) you can access S3 using a Gateway endpoint for Amazon S3.

    Details for these VPC endpoints are here: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

    These VPC endpoints provide access to S3 (which is a public endpoint) without needing to get internet access to your VPC resources. Ideal for 'private' connectivity to public Amazon services.

2 Antworten
5
Akzeptierte Antwort

You should be able to solve this problem by using a VPC endpoint for S3. A VPC endpoint enables you to privately connect your VPC to supported AWS services without requiring an internet connection, keeping the traffic within the AWS network. From a high level the steps would be to create an VPC endpoint for S3, and then to modify your bucket policy to allow access from your VPC. Your lambda function can still generate pre-signed URL's but the request will be routed over the VPC endpoint instead of the internet.

https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#vpc-endpoints-s3

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html

If this helped please remember to mark this answer as accepted. Thanks and good luck.

profile pictureAWS
beantwortet vor einem Jahr
profile picture
EXPERTE
überprüft vor 2 Monaten
profile picture
EXPERTE
überprüft vor einem Jahr
profile picture
EXPERTE
überprüft vor einem Jahr
2

You don't need NATGW or IGW, only s3 gateway vpc endpoint would serve the prupose.

You would need to configure Gateway VPC endpoint for S3 and add the the associated Route Table for that private subnet, then access to objects stored in S3 accessed via a Signed URL would work without a NAT Gateway or IGW.

Configure VPC Endpoint for S3 to be used by Private Subnets. Generate a signed URL for an object and try to use wget from EC2 instance from private subnet to retrieve it.

Hope this helps.

profile pictureAWS
EXPERTE
beantwortet vor einem Jahr
profile picture
EXPERTE
überprüft vor einem Jahr

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen