Restrict S3 Bucket to VPC Endpoint with aws:SourceVpce
A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?
Quick Answer
The correct answer is the bucket policy using the `aws:SourceVpce` condition key with the specific VPC endpoint ID. This works because the `aws:SourceVpce` condition key explicitly restricts access to traffic originating from a particular VPC endpoint, ensuring that only requests routed through that specific endpoint—and not any other endpoint or network path—can reach the S3 bucket. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of VPC endpoint policies versus bucket policies, and the common trap is confusing `aws:SourceVpc` (which allows any endpoint in the VPC) with `aws:SourceVpce` (which locks it to one endpoint). A key memory tip is to think “Vpce = endpoint-specific,” while “Vpc = whole VPC.” Remember, `aws:SourceIp` does not apply to VPC endpoint traffic, and `aws:VpcSourceIp` is not a valid key—so always look for the `SourceVpce` condition when the goal is to restrict an S3 bucket to a single VPC endpoint.
⚠ Common exam trap
It's easy for candidates to confuse `aws:SourceVpc` with `aws:SourceVpce` or mistakenly use IP-based conditions like `aws:SourceIp` or `aws:VpcSourceIp`, not realizing that for S3 bucket policies, the correct condition key to restrict to a specific VPC endpoint is `aws:SourceVpce`, and that `aws:SourceVpc` is not supported for S3 gateway endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}
It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}
Why this is correct
This condition restricts access to traffic coming through the specified VPC endpoint.
- ✗
{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}
Why it's wrong here
aws:VpcSourceIp is not a valid condition key in S3 bucket policies.
- ✗
{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}
Why it's wrong here
This uses aws:SourceVpc, which does not restrict to a specific VPC endpoint; it allows any request from within the VPC.
- ✗
{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}
Why it's wrong here
VPC endpoint traffic does not have a public IP; aws:SourceIp is not applicable.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which security mechanism should be used?
easy- ✓ A.Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.
- B.Assign an IAM role to the S3 bucket.
- C.Attach a security group to the S3 bucket.
- D.Configure a network ACL on the VPC subnet to allow traffic to S3.
Why A: An S3 bucket policy can include a condition that restricts access to traffic originating from a specific VPC endpoint. By using the `aws:SourceVpce` condition key, the policy ensures that only requests coming through the specified VPC endpoint (interface or gateway) are allowed to read objects, effectively locking down access to the VPC.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.