Lecture 59: Hands On: VPC Gateway endpoint to access S3 bucket
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：13:56
- 来源：Udemy Lecture 50324591
- Slide 数量：13
- 画面切换：00:05、03:37、03:40、03:54、05:53、06:44、07:34、08:51、09:14、10:52、12:14、12:59
扫描说明
逐条检查了 Udemy 页面中的 228 条 Transcript cue，并对全长 13:56 的视频画面进行扫描。按照短时步骤页、拓扑复查和每项控制台操作目标，共划分出 13 个小节；约 3 秒的步骤 Slide 使用暂停态精确截图。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. S3 Gateway Endpoint 实验导论
时间范围：00:00–00:05
总结 / Summary
中文
实验目标是在没有互联网出口的私有 EC2 上，通过 S3 网关端点（S3 Gateway Endpoint）上传文件到 Amazon S3，并验证路由表中的 Prefix List 路由。
English
The lab uses a private EC2 instance with no internet egress to upload a file to Amazon S3 through an S3 Gateway Endpoint and verifies the Prefix List route added to the route table.
Transcript
00:00 Okay.
00:01 So now let's look at how to use VPC gateway endpoint to access Amazon S3.
2. 实验拓扑：EC2 Instance Connect 与 S3 Endpoint
时间范围：00:05–03:37
总结 / Summary
中文
演示 VPC 含两个私有子网：一个放置应用 EC2，另一个放置 EC2 Instance Connect Endpoint，使用户可从 AWS 控制台直接登录私有实例而无需 Bastion Host 或 IGW。EC2 绑定 S3 IAM Role，出站 HTTPS 限制到 S3 Prefix List；随后创建 S3 Gateway Endpoint 并关联实例子网路由表。
English
The demo VPC contains two private subnets: one for the application EC2 instance and another for an EC2 Instance Connect Endpoint, allowing browser-based console access without a bastion host or IGW. EC2 receives an S3 IAM role, HTTPS egress is restricted to the S3 Prefix List, and an S3 Gateway Endpoint is associated with the instance subnet's route table.
Transcript
00:05 So this is your say region in which you have S3 buckets.
00:10 And then you have VPC with Cidr range of 10.1.0.0 16.
00:16 And there is an internet gateway.
00:18 There is a public subnet so that you can have a bastion host.
00:21 And then you have private subnet in that you will have your say application which would basically access
00:29 S3 bucket privately using the VPC endpoint.
00:32 Right.
00:33 And for granting the S3 permissions we would also need IAM role for this EC2 instance that we will associate
00:39 with that.
00:40 Once that is done, we will create a gateway endpoint for S3.
00:45 And we will update the route table so that traffic for S3 using that prefix list can go through the
00:51 target as VPC endpoint.
00:53 And then to test this we will ssh into the bastion host.
00:58 And from there we'll ssh into the EC2 instance, and from there we'll try to say upload some file to
01:03 the S3 bucket.
01:05 So that should be our goal, right?
01:07 While this was something I had planned initially to do, but if you are following these exercises in
01:12 this course, we always do this where we first log into the public EC2 instance and then go to the EC2
01:17 instance.
01:18 And that's for the reason that we can't directly get into the EC2 instance.
01:22 But this time I want to do things a little differently.
01:26 And that's for the reason that AWS has now capability where you can directly access this EC2 instance
01:33 using AWS console itself, and that is done using something called EC2 Instance Connect.
01:40 Now, that's not a part of this discussion, but I think this is a good time where we could experiment
01:44 with that so that you learn something new about how to access EC2 instances.
01:49 But rest of the settings, they remain as it is where we will access the VPC gateway endpoint from this
01:56 EC2 instance.
01:57 So with the EC2 instance connect, The setup is now changed.
02:01 We don't need internet gateway here for this VPC, but rather we'll have just two private subnet.
02:07 In one subnet we have this EC2 and in another subnet we will create EC2 instance connect endpoint.
02:14 So this is another way to directly access private EC2 instance from AWS console over the browser.
02:20 And there is no cost for EC2 instance connect.
02:23 So you can very well use that for your own workload as well.
02:27 So in here we will create this EC2 instance connect and then we'll have EC2 Instance Connect service
02:32 which is managed by AWS.
02:34 And from AWS Management Console we will connect to this EC2 instance connect endpoint.
02:40 And from there we will connect to this EC2 instance.
02:43 And then we will test the connectivity to the S3.
02:46 Now one thing to remember that whenever you create EC2 instance connect, there is also a security group
02:52 because it has an IP address, right?
02:54 So for EC2 instance connect in specific, we will have the outbound security group rule, which allows
03:00 the traffic of SSH to this EC2 instance.
03:04 So that's one rule you need to take care.
03:06 And for this EC2 instance we will have two rules.
03:08 Inbound should allow the SSH traffic either from this subnet, this VPC or this particular security
03:16 group of EC2 instance connect.
03:18 And then outbound rule should allow the traffic going to the S3 over port 443.
03:24 So this is something you already know.
03:26 But for instance connect we need to also allow SSH inbound right.
03:30 So I hope it is clear.
03:32 And with that the steps for our this demo will be all this.
3. 实验执行步骤清单
时间范围：03:37–03:40
总结 / Summary
中文
步骤依次包括创建两个安全组、创建 S3 访问 IAM Role、创建 EC2 Instance Connect Endpoint、启动私有 EC2、从浏览器连接、先验证 S3 上传失败、再创建 Gateway Endpoint、检查路由并验证上传成功。
English
The sequence creates two Security Groups and an S3 IAM role, creates an EC2 Instance Connect Endpoint, launches a private EC2 instance, connects from the browser, confirms that S3 upload initially fails, creates the Gateway Endpoint, verifies the route, and confirms a successful upload.
Transcript
03:37 If you want you can pause the video and read these steps.
4. 拓扑复查：仅预置 VPC 与两个 Private Subnets
时间范围：03:40–03:54
总结 / Summary
中文
AWS 账户中预先只有一个 VPC 和两个私有子网（private subnet），其余安全组、IAM Role、Instance Connect Endpoint、EC2 和 S3 Gateway Endpoint 都在演示中创建。
English
The AWS account initially contains only the VPC and two private subnets; the Security Groups, IAM role, Instance Connect Endpoint, EC2 instance, and S3 Gateway Endpoint are created during the walkthrough.
Transcript
03:40 But essentially in my AWS account I have already a VPC with two private subnets.
03:45 And that's it.
03:47 Rest of the things we will create on the fly.
03:50 Right?
03:50 So let's go to AWS console and do these things okay.
5. 实操：创建 Instance Connect 与 EC2 Security Groups
时间范围：03:54–05:53
总结 / Summary
中文
EC2 Instance Connect Endpoint 的安全组无需入站规则，但需允许到 VPC CIDR 的 SSH 出站。EC2 安全组允许 SSH 入站，并将 HTTPS 出站目标限制为 S3 的 AWS 托管 Prefix List，从而只允许实例访问 S3 服务地址。
English
The EC2 Instance Connect Endpoint Security Group needs no inbound rule but allows outbound SSH to the VPC CIDR. The EC2 Security Group permits inbound SSH and restricts outbound HTTPS to the AWS-managed S3 Prefix List so the instance can reach only S3 service addresses.
Transcript
03:54 As you can see I have a VPC.
03:56 And this VPC has two subnets one for end point and one for EC2 itself, right?
04:02 So the first thing, let's create a couple of security groups.
04:04 One for the EC2 connect endpoint and one for EC2 itself.
04:08 Right.
04:08 So let's go to the security groups and create a security group.
04:12 Let's call it EC2 Connect Endpoint Security group.
04:17 Right.
04:17 And allow SSH outbound.
04:22 That is what is required.
04:23 VPC is the demo one.
04:25 And in the outbound we need the SSH traffic going to the same VPC.
04:31 You can say or EC2 security group right.
04:34 Let's go with the VPC Cidr so that it's easy.
04:38 Now we don't need inbound rule here.
04:40 So let's create this security group okay.
04:43 Similarly let's create the security group for EC2 instance that we are going to use.
04:49 And this will allow the inbound and outbound Https right.
04:56 This should be in our demo VPC and inbound rule is for the SSH and I'm keeping it as 00000.
05:06 This is because when you use EC2 Instance Connect, you can change the setting that you have to preserve
05:12 the client IP.
05:13 And in that case it will be IP of my machine or my laptop.
05:18 But by default that is turned off, which means EC2 will see the incoming IP of the EC2 connect endpoint
05:25 itself, which will be the private IP from the VPC Cidr.
05:29 So rather, let's keep it 0000 so that it allows all the traffic.
05:34 Now outbound we need https.
05:37 That's where the traffic will go to the S3.
05:40 And in here we can use the prefix list for S3.
05:44 So you can do something like this so that traffic is restricted only to reach to the S3 bucket.
05:50 Right.
05:51 So let's create this as well.
6. 实操：创建 EC2 可承担的 S3 IAM Role
时间范围：05:53–06:44
总结 / Summary
中文
为 EC2 服务创建 IAM Role，并在演示中附加 S3 Full Access。讲师强调生产环境应按用途缩小为上传或下载所需的最小权限；网络可达性和 IAM 授权是两层独立控制。
English
An IAM role is created for the EC2 service and given S3 Full Access for the demo. The instructor notes that production permissions should be reduced to the minimum upload or download actions required; network reachability and IAM authorization are separate control layers.
Transcript
05:53 So we now have both the security groups.
05:56 Next we want to create an IAM role for EC2 instance so that it can access the S3 bucket.
06:01 So let's go to the IAM console.
06:04 Let's go to the roles and let's create a role that is for EC2 service.
06:10 So let's select that next.
06:13 And we need S3 full permission as of now.
06:16 Ideally you should have the restricted permission to either upload or download depending on your use
06:21 case.
06:22 But I am granting full permission and let's call it EC2 S3 full permission for endpoint demo.
06:32 And let's create that role.
06:36 Okay, role has been created.
06:38 Next let's also create the VPC EC2 instance connect endpoint first.
7. 实操：创建 EC2 Instance Connect Endpoint
时间范围：06:44–07:34
总结 / Summary
中文
在 Demo VPC 中选择专用私有子网和 Endpoint Security Group，创建 EC2 Instance Connect Endpoint。它用于从 AWS 管理控制台直接访问私有实例，与本讲真正测试的 S3 Gateway Endpoint 是不同类型的端点。
English
An EC2 Instance Connect Endpoint is created in the demo VPC using its dedicated private subnet and Endpoint Security Group. It enables direct console access to the private instance and is distinct from the S3 Gateway Endpoint being tested.
Transcript
06:44 So for that we have to go to the endpoints.
06:47 Now this is not a VPC gateway endpoint that we are really testing.
06:50 This is just to connect to the EC2 instance directly from the browser.
06:54 So let's create the endpoint and let's call it EC2.
06:57 to connect endpoint.
07:00 And here you will see different options.
07:03 In fact there are these new options for service network resources.
07:07 All that we will talk about a little later.
07:09 But here we have to select the EC2 instance Connect endpoint.
07:13 And the VPC is demo VPC.
07:15 And the security group is the one that we had created.
07:19 So let's see if it can search for that.
07:23 Yes it can.
07:24 So let's select that.
07:25 And the subnet is EC2 connect endpoint private subnet.
07:30 Right.
07:30 And let's create this endpoint okay.
8. 实操：启动私有 EC2 并附加 IAM Role
时间范围：07:34–08:51
总结 / Summary
中文
启动 Amazon Linux 实例，放入另一个私有子网，不需要公网 IP，并选择前面创建的 EC2 Security Group。高级设置中附加 S3 IAM Role，使 AWS CLI 获得访问目标 S3 Bucket 的凭证权限。
English
An Amazon Linux instance is launched in the other private subnet without a public IP and uses the EC2 Security Group created earlier. The S3 IAM role is attached in advanced settings so the AWS CLI receives credentials authorized for the target bucket.
Transcript
07:34 So it will take maybe a couple of minutes.
07:36 By that time we can go and create our EC2 instance.
07:40 So let's go and launch the instance.
07:43 So I'm into the Mumbai region and let's call it EC2.
07:48 And I'm using Amazon Linux because Amazon Linux already has the Instance Connect software installed.
07:55 If you are using different flavors of Linux, then it may not be there.
07:59 So you need to install the instance connect.
08:02 Okay so EC2 instance type.
08:04 Let's keep it as it is my SSH key pair network.
08:09 I want to have it in a demo VPC, and I want to have it in separate subnet that I had created for this
08:15 instance, which is this security group.
08:17 I'll select the one that we had created that was EC2, SG.
08:22 And then in the advanced settings let's attach the IAM role that we had created for EC2.
08:28 So I think it was having the long name.
08:32 Yeah S3 full permission for endpoint demo.
08:36 And I think that's it.
08:37 Let's launch the instance.
08:42 Okay this is done.
08:43 So let me wait for a minute for this instance to be running.
08:45 And then we will first login to the instance and see if we can access the S3 bucket okay.
9. 拓扑复查：Endpoint 与 Private EC2 已就绪
时间范围：08:51–09:14
总结 / Summary
中文
等待数分钟后，EC2 Instance Connect Endpoint 进入 Available，私有 EC2 也运行就绪。此时尚未创建 S3 Gateway Endpoint，因此管理连接可用，但 S3 数据路径仍不可用。
English
After a short wait, the EC2 Instance Connect Endpoint becomes Available and the private EC2 instance is running. Administrative access is now available, but the S3 data path still does not exist because the S3 Gateway Endpoint has not yet been created.
Transcript
08:51 So this EC2 connect endpoint took at least 2 to 3 minutes for it to be available.
08:56 So you would have to wait.
08:58 Now it has been created.
08:59 So I'm expecting that now we can connect to the private EC2 instance using this endpoint.
09:05 So basically we have done all this inside this VPC.
09:08 We have this instance connect and private EC2 instance.
09:11 And now let's login to this instance.
10. 实操：浏览器登录私有 EC2 并验证 S3 上传失败
时间范围：09:14–10:52
总结 / Summary
中文
从 EC2 Connect 页面选择 Instance Connect Endpoint，直接打开私有实例终端。创建 sample.txt 后执行 aws s3 cp；命令失败，因为实例没有互联网出口，默认 S3 公共端点路径不可达，这建立了创建 Gateway Endpoint 前的失败基线。
English
From the EC2 Connect page, the Instance Connect Endpoint is selected to open a browser terminal to the private instance. After creating sample.txt, an aws s3 cp command fails because the instance has no internet egress and cannot reach the default public S3 endpoint, establishing the pre-endpoint baseline.
Transcript
09:14 Okay.
09:15 So for that let's go to the EC2 and let's select this EC2 instance let's say connect.
09:20 Now in here you can connect using two methods either directly with the instance connect service or using
09:26 the endpoint.
09:27 So we have to select this endpoint here and rest of the settings as it is.
09:31 And let's say connect.
09:33 And you can see that it is trying to connect to the instance directly.
09:36 And it has connected.
09:38 So without having the internet gateway and without having the instance in a public subnet, we could
09:43 still connect directly.
09:45 Okay.
09:46 So we are into the instance.
09:48 Now let's create a dummy file so that we can test the upload to the S3 bucket.
09:53 So let's say echo this is a sample Pull file and let's call it sample dot.
10:02 TXT right.
10:05 So you can see this file here.
10:06 And let's try now.
10:08 AWS s3 cp sample.
10:14 Sample dot txt and s3.
10:18 And my S3 bucket is this.
10:20 So name is this.
10:22 So let me copy this.
10:25 And sorry copied some junk character.
10:28 So make sure that it doesn't do it in your case.
10:32 And here I'm trying to copy this file.
10:35 Now if you do this it won't work.
10:38 The reason this EC2 instance does not have outbound internet connectivity.
10:42 And by default this traffic will go over to the internet.
10:45 This is what we learned right.
10:47 So I'm just pausing this or suspending this okay.
11. 实操：创建 S3 Gateway Endpoint
时间范围：10:52–12:14
总结 / Summary
中文
在 VPC Endpoints 中选择 AWS Service 和 S3，Endpoint 类型选 Gateway，指定 Demo VPC，并关联 EC2 私有子网使用的路由表。演示暂用 Full Access Endpoint Policy；该策略控制端点可到达哪些 S3 资源，但并不替代 EC2 IAM Role 对具体操作的授权。
English
In VPC Endpoints, the instructor selects AWS Service and S3, chooses the Gateway type, selects the demo VPC, and associates the route table used by the EC2 private subnet. The demo uses a Full Access endpoint policy; that policy controls which S3 resources are reachable through the endpoint but does not replace the EC2 IAM role's operation permissions.
Transcript
10:52 So next we want to create a VPC gateway endpoint.
10:55 And then let's see if it works right.
10:58 So let's go to the VPC console again and let's go to the endpoints.
11:02 Now let's create an endpoint.
11:05 Let's call it S3 gateway endpoint.
11:09 And this is for AWS service and service name is S3.
11:14 And here you see both these options as I told earlier gateway and interface.
11:18 Now in this case we want to use gateway endpoint.
11:22 And this should be in our demo VPC.
11:24 And for this which route table has to be modified.
11:28 So there is already a route table for this subnet in which we have the EC2 instance.
11:32 So same route table will be automatically modified where the prefix list will be added to the route
11:38 table.
11:39 And I will show you shortly.
11:40 What do I mean by that?
11:42 Further, there is no policy.
11:45 So we are granting the full access to all the S3 buckets basically to reach to S3 bucket rather.
11:50 And it doesn't mean that the EC2 can put the data to all S3 bucket.
11:54 It means that VPC gateway endpoint can reach to all S3 bucket.
11:59 But if you want, you can restrict this to reach to a specific S3 bucket as well.
12:03 And that we all learned in our previous lecture.
12:06 Right.
12:07 So I'm not doing anything here.
12:09 Let's have a full access and let's create this endpoint.
12. 验证 Prefix List Route 与上传成功
时间范围：12:14–12:59
总结 / Summary
中文
Endpoint 进入 Available 后，路由表出现以 S3 Prefix List 为 Destination、Gateway Endpoint 为 Target 的新条目。再次执行相同 aws s3 cp 命令后上传成功，并在 S3 Bucket 中看到 sample.txt，证明流量已走私有端点。
English
When the endpoint becomes Available, the route table shows a new entry whose destination is the S3 Prefix List and whose target is the Gateway Endpoint. Rerunning the same aws s3 cp command succeeds, and sample.txt appears in the S3 bucket, proving that the private endpoint path is in use.
Transcript
12:14 Now ideally we don't need to do anything else because everything is set up.
12:18 This endpoint is also available.
12:20 Let's check this route table and see if we see that additional entry.
12:25 So let's wait for some time and refresh this.
12:32 So you can see that for this prefix list the endpoint has been added as a target.
12:37 So which means if we now go back to our EC2 and try the same command, it should work.
12:44 And you can see that the upload has been successful.
12:47 We can verify that by going here in S3 bucket.
12:50 And let's refresh that.
12:52 And you see that it has been uploaded.
12:55 Right.
12:56 So that's what we did in this exercise.
13. 实验回顾与资源清理
时间范围：12:59–13:56
总结 / Summary
中文
实验同时展示了两个独立能力：EC2 Instance Connect Endpoint 取代 Bastion Host 进行私有实例管理，S3 Gateway Endpoint 取代 NAT/IGW 完成 S3 数据访问。结束后应终止 EC2，并删除不再需要的端点和其他资源；若后续实验复用同一 VPC，可保留 Instance Connect Endpoint。
English
The lab demonstrates two independent capabilities: an EC2 Instance Connect Endpoint replaces a bastion host for private-instance administration, while an S3 Gateway Endpoint replaces NAT or IGW access for S3 data. Afterward, the EC2 instance and unneeded endpoints and resources should be removed, although the Instance Connect Endpoint may be retained for later labs in the same VPC.
Transcript
12:59 So basically we have tested the connectivity from this EC2 instance to this S3 bucket using the gateway
13:05 endpoint.
13:06 Now please remember the rest of the things.
13:08 This is not related to this exercise, but we could also connect to the EC2 instance using this EC2
13:14 instance connect endpoint, which is a new type of endpoint and there is no cost for that.
13:20 And you then save the cost of your bastion host.
13:22 So I think this is also a good way to avoid some cost and directly access your EC2 instance, right?
13:30 So I hope that is clear.
13:31 And if you are also doing this exercise, please delete everything that you had created.
13:36 Terminate your EC2 instances.
13:38 Uh, you may want to keep the instance connect endpoint if you are using the same VPC for other exercises.
13:44 And I am also going to do the same.
13:46 I'm just going to terminate the EC2 instance.
13:49 Right.
13:49 So that's it for this demo and I'll see you in the next lecture.
13:54 Thank you.
整讲总结 / Overall Summary
中文
本讲完整验证了 S3 Gateway Endpoint 的工作流：私有 EC2 先因无互联网出口而上传失败；创建端点并关联路由表后，AWS 自动加入 S3 Prefix List 路由，同一命令立即成功。实验还清楚区分了 Security Group、IAM Role 和 Endpoint Policy 三层控制，并用 EC2 Instance Connect Endpoint 实现无 Bastion 的私有管理访问。
English
This walkthrough validates the full S3 Gateway Endpoint workflow: a private EC2 instance first fails to upload because it has no internet egress; after the endpoint is created and associated with its route table, AWS adds the S3 Prefix List route and the same command succeeds. The lab also separates Security Group, IAM role, and endpoint-policy controls and uses an EC2 Instance Connect Endpoint for bastion-free private administration.
返回顶部 ↑