internal s3 web hosting

Based on the error message "The specified bucket does not exist" when accessing your private ALB, there are a few potential issues to check:

1. Bucket naming and configuration: When setting up an internal static website with ALB and S3, the S3 bucket name must match the domain name you're using for the ALB. Even if you haven't added a custom domain yet, the bucket name should align with what you're using in your configuration.

2. ALB target group configuration: Verify that your ALB target group is correctly configured to forward requests to the S3 VPC endpoint. The health checks passing only indicates that the ALB can reach the endpoint, not that the routing is correctly set up for your specific bucket.

3. S3 bucket policy: Check that your S3 bucket policy properly allows access from the VPC endpoint. The policy should include conditions that restrict access to requests coming through your VPC endpoint.

4. VPC endpoint configuration: Ensure that the S3 interface endpoint (not gateway endpoint) is properly configured in your VPC, as gateway endpoints are not transitive and can only be used by resources in the same VPC.

5. Request format: When using curl to test, make sure you're using the correct URL format that matches how your ALB is configured to route requests to the S3 bucket.

To fix this issue:

• Verify that the bucket name matches what the ALB is expecting
• Check the ALB listener rules to ensure they're correctly routing to your S3 endpoint
• Review your S3 bucket policy to confirm it allows access from your VPC endpoint
• Make sure you're using the correct URL format in your curl command that matches your ALB configuration
  Sources
  Set up private access to an Amazon S3 bucket through a VPC endpoint - AWS Prescriptive Guidance
  Access Private S3 static website over VPC peering with VPN | AWS re:Post

Hello,

I understand your concern and hope the steps below will help you resolve this issue. I recently implemented this exact architecture and encountered the same "The specified bucket does not exist" error you're experiencing. Here's what's happening and how to fix it.

The Problem you are facing

When following the blog post's instructions to set up an Internal ALB with a target group pointing to your S3 VPC Endpoint IP addresses, you're probably getting this error:

<Message>The specified bucket does not exist</Message>

<BucketName>internal-alb-AlbDNS.region.elb.amazonaws.com</BucketName>

You will probably notice the <BucketName> field contains your ALB's DNS name instead of your actual S3 bucket name? This reveals the root cause.

Root Cause: S3 REST API Host Header Requirement

The S3 PrivateLink Endpoint is a REST API Endpoint (accessed via the VPC Endpoint) which uses the Host header to determine which bucket to access. When you configure the ALB with a target group that forwards requests to the VPC Endpoint IPs (as described in the blog), the Host header sent to S3 contains the ALB's DNS name, not your bucket identifier.

S3 receives a request with Host: internal-alb-AlbName.region.elb.amazonaws.com and tries to find a bucket with that name, which doesn't exist.

A Solution : Use ALB Redirect Action Instead of Target Group Forward

The blog post's approach of using a target group with forward action has a fundamental flaw. Instead, you need to configure an ALB listener rule with a redirect action that sends requests to the full S3 VPC Endpoint URL including your bucket path.

Step 1: Keep Your Existing Setup

• S3 VPC Endpoint (Interface type) - already created
• Internal ALB - already created
• S3 bucket with content - already configured
• S3 bucket policy allowing VPC Endpoint access - already configured

Step 2: Find Your VPC Endpoint DNS Name

To get the correct VPC Endpoint URL:

Go to VPC Console → Endpoints Select your S3 Interface VPC Endpoint Copy the first DNS name (format: vpce-[ID]-[random].s3.[region].vpce.amazonaws.com)

Step 3: Modify Your ALB Listener Configuration

Instead of the target group approach, configure your ALB HTTPS listener with a redirect rule using previous VPC Endpoint DNS Name:

Default Action (or Listener Rule):

• Protocol: HTTPS
• Port: 443
• No pre-routing action

Routing Actions:

• Type: Redirect to URL
• Full URL: https://vpce-[YOUR-VPCE-ID]-[DNS-NAME].s3.[REGION].vpce.amazonaws.com:443/[YOUR-BUCKET-NAME]/#{path}
• Status Code: 302 (temporary) or 301 (permanent)

Example of full URL : https://vpce-abcdefg-anexample.s3.region.vpce.amazonaws.com:443/mybucket/index.html

Step 4: Remove the Target Group (Optional)

Since you're using a redirect, you no longer need the target group pointing to VPC Endpoint IPs. This also eliminates health check configuration issues.

Step 5 : Additional Configuration for Trailing Slash Handling Once the basic redirect is working, you'll want to add the trailing slash redirect rule mentioned in the blog step 4 (https://aws.amazon.com/blogs/networking-and-content-delivery/hosting-internal-https-static-websites-with-alb-s3-and-privatelink/)

Listener Rule:

Condition: Path = */

Action: Redirect

Path: /#{path}index.html

Port: #{port}

Status: 301

This ensures requests like /folder/ properly redirect to /folder/index.html.

Why This Works

The redirect approach solves the Host header problem:

1. User requests: https://internal-alb-AlbName.region.elb.amazonaws.com/index.html
2. ALB responds with HTTP 302 redirect to: https://vpce-abcdef.s3.region.vpce.amazonaws.com:443/your-bucket/index.html
3. User's browser follows the redirect
4. The request to the VPC Endpoint now has the correct Host header
5. S3 successfully identifies your bucket and serves the content

Testing Your Configuration

With working Certificate : curl -L https://internal-alb-AlbDNS.region.elb.amazonaws.com/index.html

Without Certificate : curl -Lk https://internal-alb-AlbDNS.region.elb.amazonaws.com/index.html