I have a VPC, with a VPC endpoint that is associated with a particular route table, say RTB1. Subnet1 uses RTB1 while Subnet2 doesn't.
If I attach a policy to the S3 bucket, specifying the vpc-ID as in the policy below:
{
"Version": "2012-10-17",
"Id": "Policy1415115909152",
"Statement": [
{
"Sid": "Access-to-specific-VPC-only",
"Principal": "*",
"Action": "s3:*",
"Effect": "Deny",
"Resource": ["arn:aws:s3:::my_secure_bucket",
"arn:aws:s3:::my_secure_bucket/*"],
"Condition": {
"StringNotEquals": {
"aws:sourceVpc": "vpc-111bbb22"
}
}
}
]
}
Will this allow instances in Subnet2 to access the S3 bucket? Even though those instances are not routed through RBT1, which has the vpc-endpoint entry?
Here is a summary of the behavior: