(private) elastic-beanstal environment with S3 interface instead of gateway?
I got following Environment running fine:
But when I replace the S3-gateway with S3-Interface:
the reboot of my instances fails:
Is there a known constraint, that S3Gateway must be used instead of S3 interface?
- Newest
- Most votes
- Most comments
Hello.
Do you have private DNS enabled on your S3 interface VPC endpoint?
If you do not enable this, I think ElasticBeanstalk will fail to start without going through the S3 interface VPC endpoint.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#private-dns
Its up to you when to use a S3 gateway Vs S3 endpoint. Both have different usages and reasons along with costs.
S3 gatway intercepts the traffic from a layer 3 point of view where an endpoint has to be targeted.
More information here https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/
yes that's exactly what I expect, but it simply does not work in my elastic beans context. The other interface-endpoints (as you see) work perfectly, but with s3-interface the startup fails.
BINGO! I didn't realize that the default is "disabled" in S3-interface. In all other interfaces it is "enabled" - somehow logical, due to coexistence with "S3-gateway", but also a surprising "gotcha" :). Thanks! using/cdk you also need a further workaround to get it working: https://repost.aws/questions/QUtHpqPZKeRCm5FKzGzPX1vA/enable-private-dns-only-for-inbound-endpoint