Your organization has an existing VPC with an AWS S3 VPC endpoint created and serving certain S3 buckets.
You were asked to create a new S3 bucket and reuse the existing VPC endpoint to route requests to the new S3 bucket.
However, after creating a new S3 bucket and sending requests from an EC2 instance via the VPC endpoint, you found the requests are failing with the “Access Denied” error.
What could be the issue? (select 2 options)
Click on the arrows to vote for the correct answer
A. B. C. D.Answer: A, B.
Option A is correct.
The VPC endpoint has a policy which by default allows all actions on all S3 buckets.
We can restrict access to certain S3 buckets and certain actions on this policy.
In such cases, for accessing any new buckets or for any new actions, the VPC endpoint policy needs to be modified accordingly.
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints-access.html#vpc-Option B is correct.
The AWS IAM role/user used to access the S3 bucket needs to have access granted via IAM policy before accessing.
So if the IAM role/user is not an administrator or has full S3 access, a newly created S3 bucket must be added to the IAM policy.
https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.htmlOption C is incorrect.
By default, there is no resource policy on the S3 bucket.
If we would like to make the bucket private, we can add a new resource policy with “Deny.” Please see the documentation for more information.
https://aws.amazon.com/blogs/security/how-to-create-a-policy-that-whitelists-access-to-Option D is incorrect, You can have multiple endpoint routes to different services in a route table, and you can have multiple endpoint routes to the same service in different route tables.
Still, you cannot have multiple endpoints to the same service in a single route table.
For example, if you have two endpoints to Amazon S3 in your VPC, you cannot use the same route table for both endpoints.
https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html#vpc-endpoints-limitationsThe possible issues causing the "Access Denied" error when trying to access a new S3 bucket through an existing VPC endpoint are:
A. VPC endpoint policy restriction: The VPC endpoint may have a policy attached to it that restricts access to certain S3 buckets only. This policy might not contain the new S3 bucket, causing the "Access Denied" error. To fix this issue, you need to modify the VPC endpoint policy and include the new S3 bucket in the allowed list.
D. Incorrect route table configuration: To route requests to the new S3 bucket through the VPC endpoint, you need to add a new S3 bucket hostname as the destination and VPC endpoint ID as the target in the route table. If this configuration is missing or incorrect, it can cause the "Access Denied" error. To fix this issue, you need to check the route table configuration and update it if necessary.
B. AWS IAM role/user access: If the AWS IAM role/user that is trying to access the new S3 bucket does not have the required permissions, it can cause the "Access Denied" error. To fix this issue, you need to ensure that the IAM role/user has the necessary permissions to access the new S3 bucket.
C. Default DENY policy: If an AWS default DENY policy is restricting access to the IAM user/role who already has access to the S3 bucket, it can cause the "Access Denied" error. To fix this issue, you need to modify the policy and allow access to the IAM user/role. However, this option is less likely to be the cause of the "Access Denied" error in the given scenario, as it is not common to use default DENY policies in AWS.
In summary, the most likely issues causing the "Access Denied" error in the given scenario are either the VPC endpoint policy restriction or the incorrect route table configuration. Therefore, you should first check these configurations and update them if necessary. If these configurations are correct, you should also check the IAM user/role access and default DENY policies to rule out any other possible issues.