Yes, it is possible to create a VPC endpoint for another account's S3 bucket. This is often referred to as a "cross-account VPC endpoint" configuration. Here's a brief overview of how it works:
- The VPC endpoint is created in your account and VPC.
- The S3 bucket is in another AWS account.
- The bucket owner (in the other account) needs to update their bucket policy to allow access from your VPC endpoint.
To set this up:
- Create the VPC endpoint in your account as usual.
- Get the VPC Endpoint ID.
- Have the bucket owner in the other account add a policy statement to their bucket policy that includes:
- The Principal as your AWS account ID
- The condition "aws:SourceVpce" with your VPC Endpoint ID
- In your account, ensure your IAM policies allow access to the specific bucket.
This setup allows your resources within the VPC to access the S3 bucket in the other account through the VPC endpoint, providing private connectivity without traversing the public interne