Download s3 presign url in private subnet have no internet connection

0

Hi I have a private subnet with an EC2 and a s3 bucket (same region). I have a lambda function that creates presign URL and response to EC2. I can download it with an internet connection, but when EC2 is disconnected from the internet, I can't. How can I achieve this in order to make user can download even if there is no internet? I had some ideas like a S3 access point or download by an API gateway or instead of returning presign URL, I can return blob or octet-stream. Can you guys guide me on this thing? Thanks

  • When you have a Private Subnet in a VPC (no internet connectivity) you can access S3 using a Gateway endpoint for Amazon S3.

    Details for these VPC endpoints are here: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

    These VPC endpoints provide access to S3 (which is a public endpoint) without needing to get internet access to your VPC resources. Ideal for 'private' connectivity to public Amazon services.

2개 답변
5
수락된 답변

You should be able to solve this problem by using a VPC endpoint for S3. A VPC endpoint enables you to privately connect your VPC to supported AWS services without requiring an internet connection, keeping the traffic within the AWS network. From a high level the steps would be to create an VPC endpoint for S3, and then to modify your bucket policy to allow access from your VPC. Your lambda function can still generate pre-signed URL's but the request will be routed over the VPC endpoint instead of the internet.

https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#vpc-endpoints-s3

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html

If this helped please remember to mark this answer as accepted. Thanks and good luck.

profile pictureAWS
답변함 일 년 전
profile picture
전문가
검토됨 2달 전
profile picture
전문가
검토됨 일 년 전
profile picture
전문가
검토됨 일 년 전
2

You don't need NATGW or IGW, only s3 gateway vpc endpoint would serve the prupose.

You would need to configure Gateway VPC endpoint for S3 and add the the associated Route Table for that private subnet, then access to objects stored in S3 accessed via a Signed URL would work without a NAT Gateway or IGW.

Configure VPC Endpoint for S3 to be used by Private Subnets. Generate a signed URL for an object and try to use wget from EC2 instance from private subnet to retrieve it.

Hope this helps.

profile pictureAWS
전문가
답변함 일 년 전
profile picture
전문가
검토됨 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠