Simplifying S3 Access with an Interface VPC Endpoint and Route 53

Use Route 53 private hosted zones so clients can reach S3 through a VPC endpoint without --endpoint-url.

Takahiro Iwasa

2022-11-26

2 min read

In 2022, accessing S3 through an interface VPC endpoint requires the --endpoint-url option. A Route 53 private hosted zone can map the standard regional S3 hostname to the endpoint so clients do not need to specify that option.

S3 VPC Endpoint

Create an interface VPC endpoint:

aws ec2 create-vpc-endpoint \
  --vpc-id $YOUR_VPC_ID \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.$YOUR_REGION.s3 \
  --subnet-ids $YOUR_PRIVATE_SUBNET_IDS \
  --security-group-ids $YOUR_SECURITY_GROUP_IDS

Verify the creation of the endpoint and retrieve its DNS entries:

aws ec2 describe-vpc-endpoints \
  --filters Name=service-name,Values=com.amazonaws.$YOUR_REGION.s3 \
  --query "VpcEndpoints[*].DnsEntries"

1
[
2
  [
3
    {
4
      "DnsName": "*.vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx.s3.ap-northeast-1.vpce.amazonaws.com",
5
      "HostedZoneId": "xxxxxxxxxxxxxx"
6
    },
7
    {
8
      "DnsName": "*.vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx-ap-northeast-1a.s3.ap-northeast-1.vpce.amazonaws.com",
9
      "HostedZoneId": "xxxxxxxxxxxxxx"
10
    }
11
  ]
12
]

Confirm S3 access using the VPC endpoint’s URL:

❗Important

The --region option must be specified.

aws s3 ls \
  --region <YOUR_REGION> \
  --endpoint-url http://vpce-xxxxxxxxxxxxxxxxx-xxxxxxxx.s3.ap-northeast-1.vpce.amazonaws.com

Route 53 Private Hosted Zone

A Route 53 private hosted zone removes the need to reference that URL directly:

aws route53 create-hosted-zone \
  --name s3.$YOUR_REGION.amazonaws.com \
  --vpc VPCRegion=$YOUR_REGION,VPCId=$YOUR_VPC_ID \
  --caller-reference "$(date)"

Add an A (ALIAS) record pointing to the VPC endpoint using the Route 53 console.

Click Create record.

Select A as the record type and choose Alias to VPC endpoint as the routing target.

After configuring the hosted zone, you can access S3 without specifying the --endpoint-url option:

❗Important

The --region option must be specified.

aws s3 ls --region ap-northeast-1

Conclusion

Pairing an S3 interface VPC endpoint with a Route 53 private hosted zone allows aws s3 ls to use the private endpoint without passing --endpoint-url.

Create the private hosted zone for s3.$YOUR_REGION.amazonaws.com and add an A (ALIAS) record that points to the interface endpoint. Within an associated VPC, the standard regional S3 hostname then resolves to the VPC endpoint. This is useful for tools and SDKs that do not provide an easy way to set a custom endpoint because no client-side code changes are required.

The private hosted zone is visible only through its associated VPCs. Clients in another VPC require a hosted-zone association, while on-premises clients require an appropriate DNS forwarding path, such as Route 53 Resolver endpoints and rules.

Back to posts