Download s3 presign url in private subnet have no internet connection

0

Hi I have a private subnet with an EC2 and a s3 bucket (same region). I have a lambda function that creates presign URL and response to EC2. I can download it with an internet connection, but when EC2 is disconnected from the internet, I can't. How can I achieve this in order to make user can download even if there is no internet? I had some ideas like a S3 access point or download by an API gateway or instead of returning presign URL, I can return blob or octet-stream. Can you guys guide me on this thing? Thanks

  • When you have a Private Subnet in a VPC (no internet connectivity) you can access S3 using a Gateway endpoint for Amazon S3.

    Details for these VPC endpoints are here: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

    These VPC endpoints provide access to S3 (which is a public endpoint) without needing to get internet access to your VPC resources. Ideal for 'private' connectivity to public Amazon services.

2 réponses
5
Réponse acceptée

You should be able to solve this problem by using a VPC endpoint for S3. A VPC endpoint enables you to privately connect your VPC to supported AWS services without requiring an internet connection, keeping the traffic within the AWS network. From a high level the steps would be to create an VPC endpoint for S3, and then to modify your bucket policy to allow access from your VPC. Your lambda function can still generate pre-signed URL's but the request will be routed over the VPC endpoint instead of the internet.

https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#vpc-endpoints-s3

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html

If this helped please remember to mark this answer as accepted. Thanks and good luck.

profile pictureAWS
répondu il y a un an
profile picture
EXPERT
vérifié il y a 2 mois
profile picture
EXPERT
vérifié il y a un an
profile picture
EXPERT
vérifié il y a un an
2

You don't need NATGW or IGW, only s3 gateway vpc endpoint would serve the prupose.

You would need to configure Gateway VPC endpoint for S3 and add the the associated Route Table for that private subnet, then access to objects stored in S3 accessed via a Signed URL would work without a NAT Gateway or IGW.

Configure VPC Endpoint for S3 to be used by Private Subnets. Generate a signed URL for an object and try to use wget from EC2 instance from private subnet to retrieve it.

Hope this helps.

profile pictureAWS
EXPERT
répondu il y a un an
profile picture
EXPERT
vérifié il y a un an

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions