Access S3 VPC Endpoint Interface through custom domain

Question

Hi there.

I'm developing an architecture which will send objects to AWS S3. I intend to send objects privately (without Internet traffic) using AWS PrivateLink. We've already created a VPC Interface Endpoint, so communication between on-premise servers and S3 Bucket is working correctly using VPC Endpoint, as we want. For knowledge, we use AWS Direct Connect to grant private and dedicated connection from our local datacenter to AWS infrastructure.

Although the communication is working, we plan to explore an alternative way to using VPC Endpoint DNS. Currently, the application is using regional DNS VPC Endpoint. However, to make easier application updates, future migrations or whatever other benefits, we want to know if it's possible to use a custom DNS name that points to VPC Interface Endpoint.

We did a test creating a Private Hosted Zone in AWS Route53 (we specified the same VPC where VPC Endpoint was created) with Alias record to VPC Endpoint. During the test, we tried to access S3 Bucket through DNS Record (which points to VPC Endpoint DNS) and we have received the following error:

SSL validation failed for https://private.endpoint.example/ ("hostname 'private.endpoint.example' doesn't match either of... <A list of AWS allowed hostnames>

Is there a way to use a custom and private DNS to access the S3 Bucket using VPC Endpoint? If positive, this solution is applicable for either EC2 Instance and onpremise servers?

Leo K · Accepted Answer

I think the reply from the AI bot is wrong. When a custom endpoint URL is specified, the underlying AWS SDK should validate the TLS certificate against the hostname in the specified custom URL. The TLS certificate on the interface endpoint for a given region's S3 service is always going to have the names of the S3 service, and they will never match your custom domain name.

It's technically possible to disable TLS certificate validation for the AWS SDK and CLI, but aside from the obvious security implications, I think the overall design still wouldn't work, because the "Host" header of the requests would contain your custom domain name which S3 wouldn't recognise.

The recommended and secure solution is to keep TLS certificate validation enabled and use the native names of the endpoints to access S3 in each region. Custom DNS aliases would conflict with the non-custom TLS implementation in the service.

You could streamline the management of your endpoints by configuring your on-premises DNS servers with a CNAME record aliasing the region-specific name of the S3 service to the corresponding VPC interface endpoint's native amazonaws.com name. For example, for the eu-west-1 region, you'd have a CNAME record on premises pointing s3.eu-west-1.amazonaws.com to the region's interface endpoint, such as vpce-1a2b3c4d-5e6f.s3.eu-west-1.vpce.amazonaws.com. This way, when on-premises clients connected normally to an S3 bucket in eu-west-1, they'd naturally connect to the VPC endpoint and not to the internet-facing endpoints of S3. This mimics the "private DNS" option of VPC interface endpoints.

For cloud-hosted workloads, you can use a VPC gateway endpoint for accessing S3 in the same region as the VPC. It requires nothing special for DNS.

For systems in a given region's VPC to access S3 buckets in remote regions, you could configure Route 53 private hosted zones (PHZ) to establish similar mappings with Route 53 alias records (e.g., s3.eu-west-1.amazonaws.com -> vpce-1a2b3c4d-5e6f.s3.eu-west-1.vpce.amazonaws.com). Another option would be to use Route 53 Resolver endpoints to route DNS requests between regions, but it can get quite complicated to set up and pricey to use, particularly because enabling private DNS for the VPC interface endpoints would also cause requests from inside those VPCs to have to pay the per-GB traffic fees for S3 traffic local to the region.

re:Post Agent · Answer

Yes, it is possible to use a custom domain name to access an S3 bucket through a VPC Interface Endpoint, but there are some important considerations to address the SSL validation error you're encountering.

The error occurs because the SSL certificate presented by the S3 service doesn't match your custom domain name. To resolve this issue, you need to properly set up the DNS configuration:

1. For your Route 53 private hosted zone, instead of using an Alias record, you should create a CNAME record that points to the VPC endpoint DNS name. For example:
```
private.endpoint.example CNAME vpce-abcdefgh123456789.s3.region.vpce.amazonaws.com
```

2. When making requests to S3 through your application, you need to pass the endpoint URL parameter in your AWS CLI or SDK configuration. This tells the AWS SDK to use your custom domain while still validating the SSL certificate correctly.

3. For on-premises servers accessing this custom domain, you'll need to ensure that your on-premises DNS can resolve the private domain name. You can use Route 53 Resolver endpoints and Resolver rules to extend your private hosted zone resolution to your on-premises network through your Direct Connect connection.

This solution is applicable for both EC2 instances within the VPC and on-premises servers connected via Direct Connect, provided the DNS resolution is properly configured. For on-premises servers, the Route 53 Resolver is crucial as it allows your on-premises network to resolve the private hosted zone records.

When implementing this approach, remember that the AWS SDK needs to be configured to use the custom endpoint URL while still being able to authenticate properly with the S3 service.  
**Sources**  
[Use VPC endpoints to access Amazon S3 buckets from EC2 instances | AWS re:Post](https://repost.aws/knowledge-center/s3-vpc-endpoints)  
[Access VPC resources through AWS PrivateLink - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html)  
[Implementing custom domain names for private endpoints with Amazon API Gateway | AWS Compute Blog](https://aws.amazon.com/blogs/compute/implementing-custom-domain-names-for-private-endpoints-with-amazon-api-gateway/)

Access S3 VPC Endpoint Interface through custom domain

Add your answer

Relevant content