wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

The endpoint that works for everyone except the people who need it

The in-VPC services read and write S3 through a gateway endpoint. It costs nothing, it keeps the traffic off the internet, and it has worked perfectly for two years.

The data-warehouse team on-premises now needs the same buckets, over the existing Direct Connect circuit, and without their requests being addressed to S3's public endpoint. They were told to use the endpoint that is already there.

Place what the on-premises callers use to reach S3 privately. The in-VPC path must keep working and must not start costing money.
Components — tap one, then tap a slot on the diagram
!The on-premises batch job resolves the S3 endpoint to a public address and the connection is refused by the egress firewall. Adding the endpoint's prefix list to the allowed prefixes on the Direct Connect gateway association changed nothing.A gateway endpoint is a ROUTE, and a route lives in a VPC route table. Nothing outside the VPC has that route table.

Boundaries, outermost first: Platform VPC: In-VPC services (already working), Gateway endpoint (a route, no IP), an empty slot for the what the circuit can route to Outside every boundary: Warehouse batch (on-premises), Direct Connect GW (outside every VPC), The buckets (one set of objects) Connections: In-VPC services calls Gateway endpoint — free path (step 1) Warehouse batch calls Direct Connect GW — the circuit (step 2) Direct Connect GW calls what the circuit can route to (step 3) what the circuit can route to calls The buckets (step 4) Gateway endpoint calls The buckets Warehouse batch must NOT reach Gateway endpoint — no route table out here

In-VPC servicesalready working
Warehouse batchon-premises
Gateway endpointa route, no IP
Direct Connect GWoutside every VPC
The bucketsone set of objects