[Yandex Cloud documentation](../../../index.md) > [Yandex Object Storage](../../index.md) > [Step-by-step guides](../index.md) > Buckets > Accessing a bucket using a service connection from VPC # Accessing a bucket using a service connection from Yandex Virtual Private Cloud To make Object Storage buckets accessible from VPC cloud networks directly, use a [VPC service connection](../../../vpc/concepts/private-endpoint.md). With this connection, you can access Object Storage via VPC [internal IP addresses](../../../vpc/concepts/address.md#internal-addresses) without any Internet access. To enable access to a bucket using a service connection from VPC: 1. [Create a VPC service connection](#create-endpoint). 1. [Configure a bucket policy](#setup-policy). 1. [Configure a restriction for access only from service connections](#setup-service-restriction). ## Create a VPC service connection {#create-endpoint} To create a service connection, you need one of the following [roles](../../../vpc/security/index.md#roles-list): * `vpc.privateEndpoints.editor` * `vpc.privateEndpoints.admin` * `vpc.privateAdmin` * `vpc.admin` * `admin` {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), navigate to the folder where you want to set up a service connection. 1. Navigate to **Virtual Private Cloud**. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/globe.svg) **Service connections**. 1. Click **Create connection**. 1. In the **Name** field, enter a name for the service connection. Make sure to follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. Optionally, in the **Description** field, add a description. 1. Optionally, add [labels](../../concepts/tags.md): 1. Click **Add label**. 1. Add a label in `key: value` format. 1. Press **Enter**. 1. Under **Network settings**: 1. In the **Network** field, specify a network for the new service connection. 1. To assign a random private IP address, select `Automatic` in the **Address** field. 1. To reserve a list of IP addresses: 1. In the **IP address** field, select `List`. 1. Click **Reserve**. 1. In the window that opens: * Specify a name and description for the IP address. * Select a [subnet](../../../vpc/concepts/network.md#subnet). * Assign an internal IPv4 address, e.g., `172.16.0.3`. * Enable **Deletion protection** for the address to be immune from deletion until you disable protection. * Add labels. * Click **Create**. * Repeat these steps to reserve additional IP addresses. 1. In the **Service** field, select **Object Storage**. 1. Optionally, enable **Create primary DNS record** to automatically create an additional DNS A record for the service's public [FQDN](../../../vpc/concepts/address.md#fqdn). The record will contain the internal IP address allocated to the service connection. Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage: * The parameter is not used: Name | Type | Value --- | --- | --- storage.pe.yandexcloud.net | A | *.storage.pe.yandexcloud.net | A | * The parameter is used: Name | Type | Value --- | --- | --- storage.pe.yandexcloud.net | A | *.storage.pe.yandexcloud.net | A | storage.yandexcloud.net | A | *.storage.yandexcloud.net | A | 1. Click **Create**. - Yandex Cloud CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. View the description of the CLI command to create a service connection: ```bash yc vpc private-endpoint create --help ``` 1. Create a service connection to Object Storage in the default folder: ```bash yc vpc private-endpoint create \ --name \ --description "" \ --network-name \ --service-name yandex.cloud.storage ``` Where: * `--name`: (Optional) Service connection name. * `--description`: (Optional) Service connection description. * `--network-name`: Name of the [cloud network](../../../vpc/concepts/network.md#network) the service connection will be created in. You can also use the [network ID](../../../vpc/operations/network-get-info.md) in the `--network-id` parameter. * `--service-name`: [Service connection type](../../../vpc/concepts/private-endpoint.md#pe-services). In our example, it is `yandex.cloud.storage`, Object Storage. When creating a service connection, you can use the following additional parameters: * `--address-spec`: (Optional) Parameters in the `key=value` format for the internal IP address which will be assigned to the service connection: * `address`: (Optional) Private IP address for the service connection. If no IP address is provided, a random one will be assigned from the specified subnet’s range. * `subnet-id`: (Optional) [ID of the subnet](../../../vpc/operations/subnet-get-info.md) to provide an IP address for the service connection. If no subnet ID is provided, a random internal IP address will be assigned from the range of one of the subnets in the cloud network. {% note info %} To create a service connection, you should have at least one subnet in your network. {% endnote %} * `--private-dns-records-enabled`: (Optional) Parameter to create additional DNS [resource records](../../../dns/concepts/resource-record.md) to override the public FQDN of the service to which the connection is created. Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage: * The parameter is not used: Name | Type | Value --- | --- | --- storage.pe.yandexcloud.net | A | *.storage.pe.yandexcloud.net | A | * The parameter is used: Name | Type | Value --- | --- | --- storage.pe.yandexcloud.net | A | *.storage.pe.yandexcloud.net | A | storage.yandexcloud.net | A | *.storage.yandexcloud.net | A | 1. Make sure the service connection is created: ```bash yc vpc private-endpoint list ``` Result: ```text +----------------------+-------------+--------------------------------+ | ID | NAME | DESCRIPTION | +----------------------+-------------+--------------------------------+ | enpd7rq************* | s3-vpc-link | Private Endpoint to the Object | | | | Storage | +----------------------+-------------+--------------------------------+ ``` - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. 1. In the Terraform configuration file, describe the resources you want to create: ```hcl resource "yandex_vpc_private_endpoint" "my-vpc-endpoint" { name = "" description = "" network_id = "" service_type = "yandex.cloud.storage" # Creating additional DNS resource records dns_options { private_dns_records_enabled = } endpoint_address { subnet_id = "" } } ``` Where: * `name`: Service connection name. This is an optional parameter. * `description`: Service connection description. This is an optional parameter. * `network_id`: Name of the [cloud network](../../../vpc/concepts/network.md#network) the service connection will be created in. This is a required parameter. * `service_type`: [Service connection type](../../../vpc/concepts/private-endpoint.md#pe-services). In our example, it is `yandex.cloud.storage` for Object Storage. * `dns_options`: Section with parameters for creating DNS records: * `private_dns_records_enabled`: Parameter to create additional DNS resource records to override the public FQDN of the service to which the connection is created. This is an optional parameter. Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage: * The parameter is not used: Name | Type | Value --- | --- | --- storage.pe.yandexcloud.net | A | *.storage.pe.yandexcloud.net | A | * The parameter is used: Name | Type | Value --- | --- | --- storage.pe.yandexcloud.net | A | *.storage.pe.yandexcloud.net | A | storage.yandexcloud.net | A | *.storage.yandexcloud.net | A | * `endpoint_address`: Section with parameters of the service connection's internal IP address: * `subnet_id`: ID of the subnet to provide an IP address for the service connection. If no subnet ID is provided, a random internal IP address will be assigned from the range of one of the cloud network's subnets. This is an optional parameter. {% note info %} To create a service connection, you should have at least one subnet in your network. {% endnote %} For more on the properties of the `yandex_vpc_private_endpoint` resource, see [this provider guide](../../../terraform/resources/vpc_private_endpoint.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources in the [management console](https://console.yandex.cloud) or using this [CLI](../../../cli/index.md) command: ```bash yc vpc private-endpoint list ``` - API {#api} To create a VPC service connection, use the [create](../../../vpc/privatelink/api-ref/PrivateEndpoint/create.md) REST API method for the [PrivateEndpoint](../../../vpc/privatelink/api-ref/PrivateEndpoint/index.md) resource or the [PrivateEndpointService/Create](../../../vpc/privatelink/api-ref/grpc/PrivateEndpoint/create.md) gRPC API call. {% endlist %} Save the service connection ID. Object Storage buckets are now accessible via the VPC internal IP address without any internet access. ## Configure a bucket policy {#setup-policy} To allow access to a bucket only by VPC internal IP addresses, configure a bucket policy for the service connection. {% note info %} At the [access policy](../../concepts/policy.md) level, you can grant access to the bucket from VPC service connections with IDs specified in the policy. However, as the [access flow chart](../../security/overview.md#scheme) shows, the bucket will still be accessible from the public network, e.g., though an object [ACL](../../concepts/acl.md) or under another enabling rule in the policy. In addition, a bucket configured this way still supports [server-side copy](../objects/copy.md), both from and to the bucket. {% endnote %} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you configured the VPC service connection. 1. Navigate to **Object Storage**. 1. Select the bucket from the list. 1. In the left-hand menu, go to the ![image](../../../_assets/console-icons/persons-lock.svg) **Security** tab. 1. At the top of the screen, navigate to the **Access policy** tab. 1. Click **Configure access**. 1. Enter a bucket policy ID, e.g., `private-endpoint-policy`. 1. Set up a rule: 1. Enter a rule ID, e.g., `private-endpoint-rule`. 1. Configure rule settings: * **Result**: Enable. * **Selection principle**: Include users. * **User**: All users. * **Action**: Select **All actions**. * **Resource** — `/*`. Click **Add resource** and enter ``. {% note info %} A bucket resource does not include resources of all its objects. To make sure a bucket policy rule refers to the bucket and all the objects, specify them as separate resources, e.g., `samplebucket` and `samplebucket/*`. {% endnote %} 1. Add a [condition](../../s3/api-ref/policy/conditions.md) for the rule: * In the **Key** field, select `private-endpoint-id`. * In the **Operator** field, select `StringEquals`. * In the **Value** field, specify the service connection (private endpoint) ID, e.g., `enpd7rq1s3f5********`. 1. Click **Save**. - Yandex Cloud CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. See the description of the CLI command for updating bucket settings: ```bash yc storage bucket update --help ``` 1. Describe your bucket policy configuration as a JSON [data schema](../../s3/api-ref/policy/scheme.md): ```json { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Principal": "*", "Action": "*", "Resource": [ "arn:aws:s3:::/*", "arn:aws:s3:::" ], "Condition": { "StringEquals": { "yc:private-endpoint-id": "" } } } } ``` Where: * ``: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., `my-s3-bucket`. * ``: Service connection ID (private endpoint), e.g., `enpd7rq1s3f5********`. 1. Save the final configuration to a file named `policy.json`. 1. Run this command: ```bash yc storage bucket update \ --name \ --policy-from-file ``` Once the bucket policy is applied, you can access the bucket only from the VPC cloud network in which you created the relevant service connection (private endpoint). - AWS CLI {#aws-cli} {% note info %} To manage a policy using the AWS CLI, a service account needs the `storage.admin` [role](../../security/index.md#storage-admin). {% endnote %} If you do not have the AWS CLI yet, [install and configure it](../../tools/aws-cli.md). 1. Describe your bucket policy configuration as a JSON [data schema](../../s3/api-ref/policy/scheme.md): ```json { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Principal": "*", "Action": "*", "Resource": [ "arn:aws:s3:::/*", "arn:aws:s3:::" ], "Condition": { "StringEquals": { "yc:private-endpoint-id": "" } } } } ``` Where: * ``: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., `my-s3-bucket`. * ``: Service connection ID (private endpoint), e.g., `enpd7rq1s3f5********`. 1. Save the final configuration to a file named `policy.json`. 1. Run this command: ```bash aws s3api put-bucket-policy \ --endpoint https://storage.yandexcloud.net \ --bucket \ --policy file://policy.json ``` Once the bucket policy is applied, you can access the bucket only from the VPC cloud network in which you created the relevant service connection (private endpoint). - Terraform {#tf} If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. By default, Terraform uses an IAM token for authentication in Object Storage. In addition to an IAM token, you can use a service account and static access keys for authentication to Object Storage. For more information on Terraform authentication features in Object Storage, see [this provider guide](../../../terraform/resources/storage_bucket.md). {% note info %} If you access Object Storage via Terraform under a [service account](../../../iam/concepts/users/service-accounts.md), [assign](../../../iam/operations/sa/assign-role-for-sa.md) to the service account the relevant [role](../../security/index.md#roles-list), e.g., `storage.admin`, for the folder you are going to create the resources in. {% endnote %} 1. Open the Terraform configuration file and specify the policy using the `yandex_storage_bucket_policy` resource: ```hcl resource "yandex_storage_bucket_policy" "bpolicy" { bucket = "my-policy-bucket" policy = </*", "arn:aws:s3:::" ], "Condition": { "StringEquals": { "yc:private-endpoint-id": "" } } } } POLICY } ``` Where: * ``: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., `my-s3-bucket`. * ``: Service connection ID (private endpoint), e.g., `enpd7rq1s3f5********`. For more information on the properties of the `yandex_storage_bucket_policy` resource, see [this provider guide](../../../terraform/resources/storage_bucket_policy.md). 1. Apply the changes: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. You can check the update using the [management console](https://console.yandex.cloud). - API {#api} To configure a bucket policy, use the [update](../../api-ref/Bucket/update.md) REST API method for the [Bucket](../../api-ref/Bucket/index.md) resource, the [BucketService/Update](../../api-ref/grpc/Bucket/update.md) gRPC API call, or the [PutBucketPolicy](../../s3/api-ref/policy/put.md) S3 API method. If the bucket already had a bucket policy configured, it will be completely overwritten once you apply the new policy. {% endlist %} Learn more about managing a bucket policy in [Bucket policy management](policy.md). ## Configure a restriction for access only from service connections {#setup-service-restriction} You can restrict access to a bucket at the service level. This will make access to the bucket possible only from VPC service connections. {% note warning %} With this option on, the bucket will not be accessible from the public network. There is a separate option enabling bucket access via the [management console](https://console.yandex.cloud). See also [Server side copy](#server-side-copy). {% endnote %} ### Allowing bucket access only from VPC service connections at the service level {#enable-service-restriction} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you configured the VPC service connection. 1. Navigate to **Object Storage**. 1. Select the bucket from the list. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/wrench.svg) **Settings**. 1. Under **Strict mode**, enable **Available only via VPC service connections**. 1. In the **VPC service connections** field, specify the ID of the service connection you created. 1. Optionally, enable **Access from console**. This option enables you to access the bucket from the management console even if access is allowed only via VPC service connections. When this option is disabled, you can only access the bucket via the API or CLI. 1. Click **Save**. - Yandex Cloud CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Create additional DNS [resource records](../../../dns/concepts/resource-record.md) to override the public FQDN of the service to which the connection is created. To do this, enable a special VPC service connection parameter: ```bash yc vpc private-endpoint update \ --id \ --private-dns-records-enabled ``` 1. Update the bucket settings by specifying the parameters for access only from VPC service connections: ```bash yc storage bucket update \ --name \ --enable-private-endpoints true \ --private-endpoints \ --private-endpoints-force-cloudconsole-access true ``` Where: * `--name`: Bucket name. * `--enable-private-endpoints`: Parameter for access to the bucket only from VPC service connections. If you do not set this parameter, the bucket will be accessible from both the public network and VPC service connections. * `--private-endpoints`: List of IDs of VPC service connections to allow access from. {% note warning %} If you do not specify the IDs of VPC service connections, the bucket will not be accessible from anywhere. However, you can still [disable](#disable) the restrictions for access only from VPC service connections. {% endnote %} * `--private-endpoints-force-cloudconsole-access`: This parameter enables bucket access from the management console even if access is allowed only via VPC service connections. This is an optional parameter. When this option is disabled, you can only access the bucket via the API or CLI. - API {#api} To allow bucket access only from VPC service connections at the service level, use the [update](../../api-ref/Bucket/update.md) REST API method for the [Bucket](../../api-ref/grpc/Bucket/index.md) resource or the [Bucket/Update](../../api-ref/grpc/Bucket/update.md) gRPC API call. {% endlist %} ### Restoring bucket access from a public network {#disable} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you configured the VPC service connection. 1. Navigate to **Object Storage**. 1. Select the bucket from the list. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/wrench.svg) **Settings**. 1. Under **Strict mode**, disable **Available only via VPC service connections**. 1. Click **Save**. - Yandex Cloud CLI {#cli} Update the bucket settings: ```bash yc storage bucket update \ --name \ --enable-private-endpoints false ``` Where: * `--name`: Bucket name. * `--enable-private-endpoints`: Parameter for access to the bucket only from VPC service connections. {% note tip %} After you remove the restriction for access only from VPC service connections, the list of service connections provided earlier in the `--private-endpoints` parameter remains in the bucket settings. If you choose to restrict access again, you do not have to provide the list one more time. {% endnote %} - API {#api} To allow bucket access only from VPC service connections at the service level, use the [update](../../api-ref/Bucket/update.md) REST API method for the [Bucket](../../api-ref/grpc/Bucket/index.md) resource or the [Bucket/Update](../../api-ref/grpc/Bucket/update.md) gRPC API call. {% endlist %} ### Server-side copy {#server-side-copy} For details on [server-side copy](../objects/copy.md) in buckets with access restricted to VPC service connections, refer to this table: Source bucket | Target bucket | Condition to initiate server-side copying^1^ --- | --- | --- Access restricted to VPC service connections | Access restricted to VPC service connections | Request from a service connection listed as allowed for both buckets Access restricted to VPC service connections | Access from a public network | Request from a service connection listed as allowed for the source bucket Access from a public network | Access restricted to VPC service connections | Request from a service connection listed as allowed for the target bucket Access from a public network | Access from a public network | Request from a public network or service connection ^1^ If the client has permissions to read from the source bucket and write to the target bucket. #### Useful links {#see-also} * [VPC service connections](../../../vpc/concepts/private-endpoint.md) * [Managing VPC service connections](../../../vpc/operations/index.md#private-endpoint) * [Bucket policy](../../concepts/policy.md) * [Connecting to Object Storage from Virtual Private Cloud](../../tutorials/storage-vpc-access.md) * [Access management methods in Object Storage: Overview](../../security/overview.md)