Lecture 67: VPC endpoints security
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:36
- 来源：Udemy Lecture 50324635
- Slide 数量：8
- 画面切换：00:09、02:44、04:06、05:43、06:58、07:10、08:27
扫描说明
逐条检查了 Udemy 页面中的 141 条 Transcript cue，并对全长 09:36 的视频画面进行扫描。依据标题、网络层、IAM 策略、默认/自定义 Endpoint Policy、资源策略与 S3 Bucket Policy 示例等画面切换，共划分出 8 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Endpoint Security 导论
时间范围：00:00–00:09
总结 / Summary
中文
本讲从网络层（network layer）和权限层（permissions layer）两个维度分析 VPC Endpoint 的安全控制，这是考试中的重要主题。
English
This lecture analyzes VPC endpoint security at two levels: the network layer and the permissions layer. It is an important exam topic.
Transcript
00:00 Okay, so in this lecture let's focus on the VPC endpoint security.
00:04 And again this is an important topic for your exam right.
2. Network Layer：Route Table 与 Security Group
时间范围：00:09–02:44
总结 / Summary
中文
客户端安全组（Security Group）必须允许访问服务端口的出站流量。网关端点（Gateway Endpoint）没有 ENI，因此不关联 Security Group，路径主要由路由表（route table）控制；接口端点（Interface Endpoint）具有 Endpoint ENI，其 Security Group 必须允许来自客户端私有 IP、VPC CIDR 或客户端 Security Group 的入站端口。
English
The client Security Group must permit outbound traffic to the service port. A Gateway Endpoint has no ENI and therefore no Security Group, so its path is primarily controlled by the route table. An Interface Endpoint has endpoint ENIs whose Security Group must permit inbound traffic from the client's private IP, the VPC CIDR, or the client Security Group.
Transcript
00:09 So this is now the familiar architecture to you where we have the private subnet we have the client.
00:15 And then you can access AWS services or your own services hosted as VPC endpoint service uh in your
00:23 own VPC.
00:24 Right.
00:25 And to access AWS services, as you know, uh, for S3 and DynamoDB you can use gateway endpoint.
00:31 And for that you have to modify the route tables, uh, and otherwise rest of the AWS services or say
00:36 most of the AWS services can be accessed through the interface endpoint.
00:40 And that is Eni there.
00:42 Right now, if you apply the security lens to VPC endpoints, then there are two layers of security,
00:49 one at the network layer and second at the permissions level that we refer to IAM in AWS.
00:57 Right.
00:58 So with respect to the network, as you know, mostly it will be the security groups through which you
01:03 can control the access to the respective, say, endpoint or endpoint services.
01:08 So from the client perspective, if the client wants to reach to any of the service, say S3 or this
01:14 network load balancer, then of course you would have to open the security group outbound rule there,
01:20 right?
01:20 So for example, for S3 you will open the security group say for four three, right.
01:25 That is outbound security group.
01:27 And if you have this NLB which is having the listener on 403 or support any custom port like 8080,
01:36 then also you would have to have that port in your outbound rule.
01:41 So that's about the EC2 outbound rule, right?
01:44 Now for the gateway endpoint there is no Eni.
01:47 That means there is no security group.
01:49 So here you control rest of the traffic using the route table entry that you add here, right?
01:55 I hope it is clear and you remember that.
01:57 But for the Privatelink or say interface endpoint there is Eni.
02:01 And that means there is also a security group.
02:04 And in here you have to control the inbound security group.
02:04 So you will allow the same ports and the source will be the EC2 client IP address that is a private
02:14 IP address.
02:14 Or you can have entire VPC cider range as the source, or you can have the security group of this EC2
02:22 instance as a source.
02:24 So overall at network layer these are the two security controls probably you can have while using the
02:31 VPC endpoint.
02:32 And we have already talked about this in the previous lectures.
02:36 However, in this lecture we want to focus more on the permissions.
02:39 And as you know in AWS that is done through the IAM policies.
3. Permissions Layer：Endpoint 与 Resource Policies
时间范围：02:44–04:06
总结 / Summary
中文
权限层有两类主要控制：附加到 VPC Endpoint 的端点策略（VPC Endpoint Policy），以及附加到 AWS 资源的基于资源的策略（resource-based policy）。例如 S3 Bucket Policy 可进一步限定只有指定 Endpoint 才能访问 Bucket，从而与 Endpoint Policy 形成双重限制。
English
The permissions layer has two primary controls: a VPC Endpoint Policy attached to the endpoint and a resource-based policy attached to the AWS resource. For example, an S3 bucket policy can allow access only through a specified endpoint, adding a second restriction alongside the endpoint policy.
Transcript
02:44 Right.
02:45 So in case of VPC endpoint there are different IAM policies that you can apply.
02:50 And those are called VPC endpoint policies.
02:53 So as you can see here there is a gateway endpoint and the interface endpoint.
02:56 So there is something called VPC endpoint policy.
03:00 And it follows similar to the IAM policy format basically.
03:04 So you can apply these policies.
03:06 And shortly we will see what kind of permissions you can manage using this policy.
03:11 So VPC endpoint policy is one of the security controls that you get.
03:15 But apart from this, you can also apply something called AWS Resource based policies.
03:21 And this is only applicable for the AWS services which support resource based policies.
03:27 So if you heard about S3 bucket policy, that is a resource based policy.
03:32 Similarly DynamoDB supports that.
03:34 API gateway supports that.
03:35 So all these are AWS resource based policies.
03:39 And there also you can define from where or who can access this particular S3 bucket.
03:46 And you can define that S3 bucket can be accessed only from this particular VPC endpoint.
03:52 So likewise you are getting now double control one at the VPC endpoint level.
03:57 And for some of the AWS services at the resource level as well.
04:02 So next in this lecture let's talk about those policies.
4. Default VPC Endpoint Policy 与服务支持
时间范围：04:06–05:43
总结 / Summary
中文
新建 Endpoint 默认附加允许全部访问的策略（default VPC Endpoint Policy）。只有服务声明支持 Endpoint Policy 时才能自定义；可通过 AWS CLI 查询 VpcEndpointPolicySupported。自建的 NLB Endpoint Service 只能使用默认策略，不能在 Endpoint 上自定义该权限控制。
English
A newly created endpoint receives a default VPC Endpoint Policy that permits full access. Customization is possible only when the service reports support for endpoint policies, which can be queried through the AWS CLI with VpcEndpointPolicySupported. Customer-owned NLB Endpoint Services use the default policy and do not support custom endpoint-policy authorization.
Transcript
04:06 Okay.
04:06 So if you do nothing and you just create the endpoint and you must be seeing that while we did the demo,
04:13 there is always a default VPC endpoint policy that is attached.
04:17 And it has this kind of format.
04:19 That means it allows access to, you know, respective AWS services.
04:23 There are no restrictions applied, right.
04:27 So this is a default VPC endpoint policy.
04:30 And otherwise custom VPC endpoint policy can also be applied if respective AWS service supports that.
04:38 And how do you really check whether respective AWS service supports the VPC endpoint policy or not?
04:44 So for that you can just fire a CLI command something like this.
04:44 And here you see there is a VPC endpoint policy supported.
04:52 So if the value is true that means that service supports the VPC endpoint policy.
04:57 Otherwise full permissions will be granted from the VPC endpoint perspective.
05:02 And then you can't really change this policy right.
05:06 Now also when you create the VPC endpoint service, that means you are hosting your services behind
05:11 the network load balancer.
05:12 There also this default policy is applied and you can't customize or you can't define the policy there.
05:19 Right.
05:19 So the bottom line is the VPC endpoint policy is applicable only for the services which supports the
05:26 endpoint policy.
05:27 So for example S3 bucket supports that.
05:29 DynamoDB table supports that SQS supports that.
05:32 Similarly API gateways.
05:34 And there are so many services.
05:36 So if you run this command you will know which all AWS services support it.
05:41 Right.
05:41 So that's the default policy.
5. Custom Endpoint Policy：限制 Resource 与 Principal
时间范围：05:43–06:58
总结 / Summary
中文
自定义端点策略（custom Endpoint Policy）可把访问限定到特定 S3 Bucket、DynamoDB Table、API Action、AWS Account、IAM User 或 IAM Role。策略中的 Principal 应保持为 *，具体账户、用户或角色应放在 Condition Block 中判断。
English
A custom endpoint policy can restrict access to a particular S3 bucket, DynamoDB table, API action, AWS account, IAM user, or IAM role. The policy Principal should remain *, while specific accounts, users, or roles are evaluated in the Condition block.
Transcript
05:43 But as I said you can always customize that for the respective AWS services.
05:48 So just an example.
05:49 If you want to restrict access to a particular S3 bucket through the endpoint, then you apply this
05:54 policy to the VPC endpoint while you create that.
05:57 And then only access to this particular S3 bucket and only for this action will be granted.
06:03 Similarly, you can do that for the DynamoDB table, right?
06:08 So I hope it is clear.
06:10 Now further, you can also restrict access to particular AWS account or a particular IAM user or role
06:18 as well.
06:19 So it checks which is the user who is making those API calls through the VPC endpoint.
06:25 So here you can see the principal account should be this or otherwise.
06:29 You can go granular.
06:31 And you can also define the IAM role or the user here.
06:36 Now just one small thing to note here is that here principal should always be star.
06:41 And you have to define this accounts or users in the condition block and not in the principal block.
06:48 Right.
06:48 So that's in a nutshell is a VPC endpoint policy.
06:51 And now let's move to the next type of the policy which I said you can also apply the policy on the
6. 转向 AWS Resource-based Policy
时间范围：06:58–07:10
总结 / Summary
中文
除了 Endpoint Policy，还可以在支持基于资源策略（resource-based policy）的 AWS 服务上直接控制访问。接下来以 Amazon S3 Bucket Policy 为例说明资源侧限制。
English
In addition to endpoint policies, access can be controlled directly on AWS services that support resource-based policies. The lecture next uses Amazon S3 bucket policies to illustrate resource-side restrictions.
Transcript
06:58 AWS resource itself.
07:00 And this is called S3 bucket policy.
07:02 So if you take an example of S3 then you can basically define different conditions in S3 bucket policy,
7. S3 Bucket Policy 的 VPC Endpoint Conditions
时间范围：07:10–08:27
总结 / Summary
中文
S3 Bucket Policy 可使用 aws:sourceVpce 只允许指定 VPC Endpoint ID，或使用 aws:sourceVpc 允许某个 VPC 中的全部 Endpoint。aws:VpcSourceIp 可限制经 Endpoint 发起请求的客户端私有 IP 范围；这些 VPC 条件只有当流量经过 VPC Endpoint 时才有意义。
English
An S3 bucket policy can use aws:sourceVpce to allow a specific VPC endpoint ID or aws:sourceVpc to allow endpoints from an entire VPC. aws:VpcSourceIp can restrict the client private IP range behind the endpoint. These VPC conditions are meaningful only when traffic traverses a VPC endpoint.
Transcript
07:10 something like this which says if the traffic is coming from particular VPC endpoint with the endpoint
07:17 ID, then only it will be allowed.
07:20 Now similarly, you can also define the source as VPC itself, and in that case, all the endpoints
07:27 within that VPC can access the S3 bucket.
07:30 So rather than adding individual endpoint IDs, basically you can define the VPC as a source.
07:37 Further, this AWS source VPC condition only applies in the context of VPC endpoints.
07:42 That means if traffic is not going through the endpoint, then this condition doesn't make any sense,
07:48 right?
07:49 So just remember that.
07:51 And further there is also one more condition element that is aws vpc source IP.
07:56 So you can define the private IP ranges from where the endpoint is being accessed.
08:02 And this is also applicable only in the context of VPC endpoint.
08:07 Otherwise AWS source IP generally refers to the public IPS from where S3 can be accessed, right?
08:14 So that is another condition that you can add to your S3 bucket policy, right?
08:21 So with all this knowledge, if you have to create a sample S3 bucket policy, then it may look like
8. Example S3 Bucket Policies 与安全总结
时间范围：08:27–09:36
总结 / Summary
中文
示例策略使用 Deny 与 StringNotEquals 的双重否定模式：拒绝所有不来自指定 VPC Endpoint 或 VPC 的请求，从而实现“只允许此私有路径”。同样的思路可应用到支持资源策略（resource-based policy）的 DynamoDB 和 API Gateway。整体上，Gateway Endpoint 由 Route Table 控制，Interface Endpoint 由 Security Group 控制，权限层再叠加 Endpoint Policy 和 Resource Policy。
English
The examples use a Deny plus StringNotEquals double-negative pattern to reject every request that does not originate from the specified VPC endpoint or VPC, effectively allowing only that private path. The same approach applies to services such as DynamoDB and API Gateway when they support resource-based policies. Overall, route tables govern Gateway Endpoints, Security Groups govern Interface Endpoints, and endpoint and resource policies add permissions-layer controls.
Transcript
08:27 this where condition says that source VPC endpoint should be this right?
08:32 Or you can say it can be entire VPC and all the VPC endpoint can access that.
08:39 Now here the effect is deny and condition is not equal.
08:42 So it's a reverse kind of only allow from this endpoint.
08:46 Ultimately it's double negation basically right.
08:49 So these are some of the bucket policies that you can apply.
08:53 And similarly you can do that for other AWS resources like DynamoDB or API gateways which we are not
09:00 covering here but very much possible.
09:03 Right.
09:04 So I think we covered almost everything with respect to the VPC endpoint security.
09:09 And just to recap, at the network layer you have the security groups.
09:13 And in case of gateway endpoint there is also route table.
09:16 But at the IAM level there are two kinds of policies.
09:19 One is VPC endpoint policy itself and otherwise.
09:24 On the AWS resource side there is resource based policies.
09:28 And that's it really.
09:29 So that's it about VPC endpoint security.
09:32 And with that now let's go to the next lecture.
09:35 Thank you.
整讲总结 / Overall Summary
中文
本讲建立了 VPC Endpoint 的分层安全模型：网络层使用客户端出站 Security Group、Endpoint ENI 入站 Security Group 和 Gateway Endpoint Route Table；权限层使用 VPC Endpoint Policy 与 AWS Resource-based Policy。默认 Endpoint Policy 允许全部访问，自定义策略可按 Resource、Action 和 IAM Principal 限制；S3 Bucket Policy 还能通过 aws:sourceVpce、aws:sourceVpc 与 aws:VpcSourceIp 强制私有访问路径。
English
This lecture establishes a layered VPC endpoint security model. The network layer uses client egress Security Groups, endpoint-ENI ingress Security Groups, and Gateway Endpoint route tables. The permissions layer uses VPC Endpoint Policies and AWS resource-based policies. The default endpoint policy allows all access, while custom policies restrict resources, actions, and IAM principals; S3 bucket policies can additionally enforce private paths with aws:sourceVpce, aws:sourceVpc, and aws:VpcSourceIp.
返回顶部 ↑