amazon-web-services - S3 存储桶策略和 S3 VPC 终端节点之间有什么区别？

Question

我很想知道使用如下存储桶策略创建 S3 存储桶的功能差异是什么:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Access-to-specific-VPC-only",
      "Principal": "*",
      "Action": "s3:*",
      "Effect": "Deny",
      "Resource": ["arn:aws:s3:::example-bucket",
                   "arn:aws:s3:::example-bucket/*"],
      "Condition": {
        "StringNotEquals": {
          "aws:sourceVpc": "vpc-111bbb22"
        }
      }
    }
  ]
}

与创建如下所示的 VPC 终端节点相比:

{
    "Name": "example-vpc-ap",
    "Bucket": "example-bucket",
    "NetworkOrigin": "VPC",
    "VpcConfiguration": {
        "VpcId": "vpc-111bbb22"
    },
    "CreationDate": "2019-11-27T00:00:00Z"
}

它们在功能上等效吗？是被贬低还是最佳实践？引用后不清楚答案是什么:

• https://docs.aws.amazon.com/AmazonS3/latest/dev/creating-access-points.html#access-points-vpc
• VPC access policy for S3 buckets
• S3 VPC end point Bucket policy

谢谢

Answer 1

我认为 aws:sourceVpc 只能与 VPC 终端节点结合使用。

来自Example Bucket Policies for VPC Endpoints for Amazon S3 - Amazon Simple Storage Service :

You can create a bucket policy that restricts access to a specific VPC by using the aws:SourceVpc condition. This is useful if you have multiple VPC endpoints configured in the same VPC, and you want to manage access to your Amazon S3 buckets for all of your endpoints.

您的问题中显示的 VPC 端点定义只是表示该端点连接到特定的 VPC。它不将存储桶访问限制为仅限该端点。用户仍然可以通过 Internet 或其他端点访问存储桶。

但是，我承认所有这些端点和配置都非常困惑!