- Newest
- Most votes
- Most comments
Hello.
If you set a route to the gateway-type VPC endpoint in the route table of the public subnet, you can access S3 via the VPC endpoint even if it is EC2 in the public subnet.
As described in the document below, routes are determined by the longest prefix match in the route table.
Therefore, if a route to the VPC endpoint is set in the route table, communication to S3 will be routed to the VPC endpoint even if it is a public subnet.
https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#gateway-endpoint-routing
- We use the most specific route that matches the traffic to determine how to route the traffic (longest prefix match). For route tables with an endpoint route, this means the following:
- If there is a route that sends all internet traffic (0.0.0.0/0) to an internet gateway, the endpoint route takes precedence for traffic destined for the service (Amazon S3 or DynamoDB) in the current Region. Traffic destined for a different AWS service uses the internet gateway.
- Traffic that's destined for the service (Amazon S3 or DynamoDB) in a different Region goes to the internet gateway because prefix lists are specific to a Region.
- If there is a route that specifies the exact IP address range for the service (Amazon S3 or DynamoDB) in the same Region, that route takes precedence over the endpoint route.
Thanks for answer.
Need i to add it here? If yes, which one?
- look in attachments.
answered 2 years ago
Well if i understand it right, i Just need to select the route table (that cointain public subnets) when creating the vpc gateway s3 endpoint Then aws Will do it, right ?
answered 2 years ago
I'm afraid about this popup info in attach image (red marked). Very confused phase.
- Looks like all instances that use subnets from this route table Will move to private, i didnt understand for sure.
answered 2 years ago
Relevant content
asked 5 years ago
No, there is an option to select a route table when creating a gateway VPC endpoint. The route will be automatically added to the selected route table. Please select the route table to which you want to add routes when creating a gateway-type VPC endpoint using the steps in the document below. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#create-gateway-endpoint-s3
You can select a route table when creating a gateway VPC endpoint as shown in the image below.
The route to the VPC endpoint is simply added to the selected route table, so EC2 will not be moved to the private subnet. The explanation you have circled in red is that the IP address used to access S3 from EC2 will change from a public IP address to a private IP address.