Simplifying S3 Access with an Interface VPC Endpoint and Route 53

Use Route 53 private hosted zones so clients can reach S3 through a VPC endpoint without --endpoint-url.

Takahiro Iwasa

2022-11-26

2 min read

The S3 interface VPC endpoint requires specifying the --endpoint-url option when accessing S3. However, to simplify access and avoid specifying this option repeatedly, Route 53 private hosted zones can be used.

S3 VPC Endpoint

Create an interface VPC endpoint:

aws ec2 create-vpc-endpoint \
  --vpc-id $YOUR_VPC_ID \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.$YOUR_REGION.s3 \
  --subnet-ids $YOUR_PRIVATE_SUBNET_IDS \
  --security-group-ids $YOUR_SECURITY_GROUP_IDS

Verify the creation of the endpoint and retrieve its DNS entries:

aws ec2 describe-vpc-endpoints \
  --filters Name=service-name,Values=com.amazonaws.$YOUR_REGION.s3 \
  --query "VpcEndpoints[*].DnsEntries"

1
[
2
  [
3
    {
4
      "DnsName": "*.vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx.s3.ap-northeast-1.vpce.amazonaws.com",
5
      "HostedZoneId": "xxxxxxxxxxxxxx"
6
    },
7
    {
8
      "DnsName": "*.vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx-ap-northeast-1a.s3.ap-northeast-1.vpce.amazonaws.com",
9
      "HostedZoneId": "xxxxxxxxxxxxxx"
10
    }
11
  ]
12
]

Confirm S3 access using the VPC endpoint’s URL:

❗ Important

The --region option must be specified.

aws s3 ls \
  --region <YOUR_REGION> \
  --endpoint-url http://vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx.s3.ap-northeast-1.vpce.amazonaws.com

Route 53 Private Hosted Zone

A Route 53 private hosted zone removes the need to reference that URL directly:

aws route53 create-hosted-zone \
  --name s3.$YOUR_REGION.amazonaws.com \
  --vpc VPCRegion=$YOUR_REGION,VPCId=$YOUR_VPC_ID \
  --caller-reference "$(date)"

Add an A (ALIAS) record pointing to the VPC endpoint using the Route 53 console.

Click Create record.

Select A as the record type and choose Alias to VPC endpoint as the routing target.

After configuring the hosted zone, you can access S3 without specifying the --endpoint-url option:

❗ Important

The --region option must be specified.

aws s3 ls --region ap-northeast-1

Conclusion

Pairing an S3 interface VPC endpoint with a Route 53 private hosted zone made aws s3 ls work over the private endpoint without ever passing --endpoint-url. Creating the private hosted zone for s3.$YOUR_REGION.amazonaws.com with an A (ALIAS) record pointing at the interface endpoint is what makes that possible — the standard S3 hostname now resolves to the VPC endpoint automatically for anything inside that VPC. That matters most for tools and SDKs that don’t expose an easy way to pass a custom endpoint, since this approach requires no code changes on the client side at all. The hosted zone’s resolution is scoped strictly to the VPC it’s associated with, though, so a client connecting from a different VPC or over an on-premises VPN won’t pick it up unless that network is associated with the same private zone.