S3: Demonstrate Your Skills

Question

I have completed all 10 questions except question 6.6. Access controlCreate an access point (AP) called metrolio-dev-ap attached to the metrolio-data-467e6352 bucket.This should allow developers working in the dev vpc vpc-08333ea4fc7562479 using the role arn:aws:iam::447645673093:role/metrolio-developer to list and get all objects in the bucket.Ensure you follow best practices of blocking public access.NOTE: AWS often faces internal errors – we believe these to be race conditions – when applying policies to new access points. You may need to re-apply the policy to the AP.I have re-applied the Access Point policy several times but still is not detected.I’m not sure if it is my Access Point policy or the AWS Immersivelabs that is at fault. Any help would be greatly appreciated.This is my Access Point Policy:{&nbsp;&nbsp;&nbsp; "Version": "2012-10-17",&nbsp;&nbsp;&nbsp; "Statement": [&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "Effect": "Allow",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "Principal": {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "AWS": "arn:aws:iam::447645673093:role/metrolio-developer"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; },&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "Action": [&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "s3:GetObject",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "s3:ListBucket"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ],&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "Resource": [&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "arn:aws:s3:eu-west-1:447645673093:accesspoint/metrolio-dev-ap/object/*",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "arn:aws:s3:eu-west-1:447645673093:accesspoint/metrolio-dev-ap"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ],&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "Condition": {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "StringEquals": {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "aws:SourceVpc": "vpc-08333ea4fc7562479"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;&nbsp;&nbsp; ]}I tried to replicate similar permissions on bucket policy only to be denied by restrictive permission.NOTE: Account ID, Bucket names and few other identifiers do not match between screenshot 1-2 and screenshot 3. The screenshot 3 is from different attempt.&nbsp;

oisinb · Answer

Morning Madan,
You're very nearly there! You just need to remove the condition block from your access point policy statement. It's not necessary when you have already set the access point's network origin to be a specific VPC.
Although the `aws:SourceVpc` condition can also restrict access to a specific VPC, it functions differently. Specifying a network origin creates a network-level restriction on the access point, whereas using a condition creates a policy-level restriction. This can be especially important if an access point policy is using `Deny` as the effect, because requests from outside of AWS VPCs (e.g., over the internet) won't have an `aws:SourceVpc` context key, so conditions may not be met as expected, providing unintended access.
Therefore, from a security perspective, it's encouraged to restrict access to the access point by setting the network origin, which gives network-level isolation.&nbsp;
Hope this helps, and well done on completing the rest of the tasks 😄

Forum Discussion

S3: Demonstrate Your Skills

1 Reply

Featured Places

Help & Support Forum

Related Content

EC2: Demonstrate Your Skills

Active Directory Basics: Demonstrate Your Skills

Zeek - Demonstrate Your Skills

Autopsy: Demonstrate Your Skills

Privilege Escalation: Linux – Demonstrate Your Skills

Recent Discussions

Privilege Escalation: Linux – Demonstrate Your Skills

S3: Demonstrate Your Skills

World Cup Special - Immersive Squad

Radare2 Reverse Engineering: Ep.2 – Windows Binary Part 2

Radare2 Reverse Engineering: Ep.1 – Windows Binary Part 1