Accessing a bucket using a service connection from Yandex Virtual Private Cloud

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

1. View the description of the CLI command to create a service connection:

   yc vpc private-endpoint create --help
   

2. Create a service connection to Object Storage in the default folder:

   yc vpc private-endpoint create \
     --name <service_connection_name> \
     --description "<service_connection_description>" \
     --network-name <network_name> \
     --object-storage 
   

   Where:

   • --name: (Optional) Service connection name.
   • --description: (Optional) Service connection description.
   • --network-name: Name of the cloud network the service connection will be created in. You can also use the network ID in the --network-id parameter.
   • --object-storage: Service connection to Object Storage. Other service connection types are not available yet.

   When creating a service connection, you can use the following additional parameters:

   • --address-spec: (Optional) Parameters in the key=value format for the internal IP address which will be assigned to the service connection:

     • address: (Optional) Private IP address for the service connection. If no IP address is provided, a random one will be assigned from the specified subnet’s range.

     • subnet-id: (Optional) ID of the subnet to provide an IP address for the service connection. If no subnet ID is provided, a random internal IP address will be assigned from the range of one of the subnets in the cloud network.

       Note

       To create a service connection, you should have at least one subnet in your network.

   • --private-dns-records-enabled: (Optional) Parameter to create additional DNS resource records to override the public FQDN of the service to which the connection is created.

     Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage:

     • The parameter is not used:

       Name	Type	Value
       storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>
       *.storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>

     • The parameter is used:

       Name	Type	Value
       storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>
       *.storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>
       storage.yandexcloud.net	A	<internal_IP_address_of_service_connection>
       *.storage.yandexcloud.net	A	<internal_IP_address_of_service_connection>

3. Make sure the service connection is created:

   yc vpc private-endpoint list
   

   Result:

   +----------------------+-------------+--------------------------------+
   |          ID          |    NAME     |          DESCRIPTION           |
   +----------------------+-------------+--------------------------------+
   | enpd7rq************* | s3-vpc-link | Private Endpoint to the Object |
   |                      |             | Storage                        |
   +----------------------+-------------+--------------------------------+
   

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the relevant documentation on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

1. In the Terraform configuration file, describe the resources you want to create:

   resource "yandex_vpc_private_endpoint" "my-vpc-endpoint" {
     name        = "<service_connection_name>"
     description = "<service_connection_description>"
     network_id  = "<cloud_network_ID>"
     
     # Service connection to Object Storage
     object_storage {}
   
     # Creating additional DNS resource records 
     dns_options {
       private_dns_records_enabled = <true_or_false>
     }
   
     endpoint_address {
       subnet_id = "<subnet_ID>"
     }
   }
   

   Where:

   • name: Service connection name. This is an optional parameter.

   • description: Service connection description. This is an optional parameter.

   • network_id: Name of the cloud network the service connection will be created in. This is a required parameter.

   • object_storage: Service connection to Object Storage. Other service connection types are not available yet.

   • dns_options: Section with parameters for creating DNS records:

     • private_dns_records_enabled: Parameter to create additional DNS resource records to override the public FQDN of the service to which the connection is created. This is an optional parameter.

       Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage:

       • The parameter is not used:

         Name	Type	Value
         storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>
         *.storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>

       • The parameter is used:

         Name	Type	Value
         storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>
         *.storage.pe.yandexcloud.net	A	<internal_IP_address_of_service_connection>
         storage.yandexcloud.net	A	<internal_IP_address_of_service_connection>
         *.storage.yandexcloud.net	A	<internal_IP_address_of_service_connection>

   • endpoint_address: Section with parameters of the service connection's internal IP address:

     • subnet_id: ID of the subnet to provide an IP address for the service connection. If no subnet ID is provided, a random internal IP address will be assigned from the range of one of the cloud network's subnets. This is an optional parameter.

     Note

     To create a service connection, you should have at least one subnet in your network.

   For more information about yandex_vpc_private_endpoint properties, see this provider guide.

2. Create the resources:

   1. In the terminal, go to the directory where you edited the configuration file.

   2. Make sure the configuration file is correct using this command:

      terraform validate
      

      If the configuration is correct, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

   4. Apply the changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   Terraform will create all the required resources. You can check the new resources using the management console or this CLI command:

   yc vpc private-endpoint list
   

To create a VPC service connection, use the create REST API method for the PrivateEndpoint resource or the PrivateEndpointService/Create gRPC API call.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

1. See the description of the CLI command for updating bucket settings:

   yc storage bucket update --help
   

2. Describe your bucket policy configuration as a JSON data schema:

   {
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": "*",
       "Action": "*",
       "Resource": [
         "arn:aws:s3:::<bucket_name>/*",
         "arn:aws:s3:::<bucket_name>"
       ],
       "Condition": {
         "StringEquals": {
           "yc:private-endpoint-id": "<connection_ID>"
         }
       }
     }
   }
   

   Where:

   • <bucket_name>: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., my-s3-bucket.
   • <connection_ID>: Service connection ID (private endpoint), e.g., enpd7rq1s3f5********.

3. Save the final configuration to a file named policy.json.

4. Run this command:

   yc storage bucket update \
     --name <bucket_name> \
     --policy-from-file <policy_file_path>
   

   Once the bucket policy is applied, you can access the bucket only from the VPC cloud network in which you created the relevant service connection (private endpoint).

If you do not have the AWS CLI yet, install and configure it.

1. Describe your bucket policy configuration as a JSON data schema:

   {
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": "*",
       "Action": "*",
       "Resource": [
         "arn:aws:s3:::<bucket_name>/*",
         "arn:aws:s3:::<bucket_name>"
       ],
       "Condition": {
         "StringEquals": {
           "yc:private-endpoint-id": "<connection_ID>"
         }
       }
     }
   }
   

   Where:

   • <bucket_name>: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., my-s3-bucket.
   • <connection_ID>: Service connection ID (private endpoint), e.g., enpd7rq1s3f5********.

2. Save the final configuration to a file named policy.json.

3. Run this command:

   aws s3api put-bucket-policy \
     --endpoint https://storage.yandexcloud.net \
     --bucket <bucket_name> \
     --policy file://policy.json
   

Once the bucket policy is applied, you can access the bucket only from the VPC cloud network in which you created the relevant service connection (private endpoint).

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

By default, Terraform uses an IAM token for authentication in Object Storage. In addition to an IAM token, you can use a service account and static access keys for authentication in Object Storage. For more information about Terraform authentication in Object Storage, see the relevant provider documentation.

1. Open the Terraform configuration file and specify the policy using the yandex_storage_bucket_policy resource:

   resource "yandex_storage_bucket_policy" "bpolicy" {
     bucket = "my-policy-bucket"
     policy = <<POLICY
   {
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": "*",
       "Action": "*",
       "Resource": [
         "arn:aws:s3:::<bucket_name>/*",
         "arn:aws:s3:::<bucket_name>"
       ],
       "Condition": {
         "StringEquals": {
           "yc:private-endpoint-id": "<connection_ID>"
         }
       }
     }
   }
   POLICY
   }
   

   Where:

   • <bucket_name>: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., my-s3-bucket.
   • <connection_ID>: Service connection ID (private endpoint), e.g., enpd7rq1s3f5********.

   For more information about yandex_storage_bucket_policy properties, see this provider guide.

2. Apply the changes:

   1. In the terminal, go to the directory where you edited the configuration file.

   2. Make sure the configuration file is correct using this command:

      terraform validate
      

      If the configuration is correct, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

   4. Apply the changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   You can check the update using the management console.

To configure a bucket policy, use the update REST API method for the Bucket resource, the BucketService/Update gRPC API call, or the PutBucketPolicy S3 API method. If the bucket already had a bucket policy configured, it will be completely overwritten once you apply the new policy.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

1. Create additional DNS resource records to override the public FQDN of the service to which the connection is created. To do this, enable a special VPC service connection parameter:

   yc vpc private-endpoint update \
     --id <service_connection_ID> \
     --private-dns-records-enabled
   

2. Update the bucket settings by specifying the parameters for access only from VPC service connections:

   yc storage bucket update \
     --name <bucket_name> \
     --enable-private-endpoints true \
     --private-endpoints <service_connection_ID> \
     --private-endpoints-force-cloudconsole-access true
   

   Where:

   • --name: Bucket name.

   • --enable-private-endpoints: Parameter for access to the bucket only from VPC service connections. If you do not set this parameter, the bucket will be accessible from both the public network and VPC service connections.

   • --private-endpoints: List of IDs of VPC service connections to allow access from.

     Warning

     If you do not specify the IDs of VPC service connections, the bucket will not be accessible from anywhere. However, you can still disable the restrictions for access only from VPC service connections.

   • --private-endpoints-force-cloudconsole-access: This parameter enables bucket access from the management console even if access is allowed only via VPC service connections. This is an optional parameter. When this option is disabled, you can only access the bucket via the API or CLI.

To allow bucket access only from VPC service connections at the service level, use the update REST API method for the Bucket resource or the Bucket/Update gRPC API call.

Update the bucket settings:

yc storage bucket update \
  --name <bucket_name> \
  --enable-private-endpoints false

Where:

• --name: Bucket name.

• --enable-private-endpoints: Parameter for access to the bucket only from VPC service connections.

  Tip

  After you remove the restriction for access only from VPC service connections, the list of service connections provided earlier in the --private-endpoints parameter remains in the bucket settings. If you choose to restrict access again, you do not have to provide the list one more time.

To allow bucket access only from VPC service connections at the service level, use the update REST API method for the Bucket resource or the Bucket/Update gRPC API call.