4 ms·
> you end up having to open network traffic to all of a particular aws service, not just yours > I could exfil data to those aws services I don't think any of
by sigstoat 4y ago
> you end up having to open network traffic to all of a particular aws service, not just yours
> I could exfil data to those aws services
I don't think any of the VPC endpoints have any restrictions on them; that is, once I've made an S3 endpoint in my VPC, it can be used to access any bucket. So... it seems like it could be used just as easily to exfiltrate data?
- cldellow 4y agoI haven't done it, but the docs seem to imply that some VPC endpoints, including S3, can support the usual policy documents to describe which actions/principals/resources are permitted: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#edit-vpc-endpoint-policy-s3 https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
- different_sort 4y agoThat is indeed the case.
- Galanwe 4y ago> once I've made an S3 endpoint in my VPC, it can be used to access any bucket. So... it seems like it could be used just as easily to exfiltrate data? On the contrary, and that is one of the strong points of using VPC endpoints. You can whitelister the buckets that are accessible through the endpoints, which means it is in fact the only way to prevent data exfiltration.