[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Step-by-step guides](index.md) > Service connections > Configuring an Object Storage restriction for access only from service connections

# Configuring an Object Storage restriction for access only from service connections

You can restrict access to a bucket at the service level. This will make access to the bucket possible only from VPC service connections.

{% note warning %}

With this option on, the bucket will not be accessible from the public network. There is a separate option enabling bucket access via the [management console](https://console.yandex.cloud). See also [Server side copy](#server-side-copy).

{% endnote %}

### Allowing bucket access only from VPC service connections at the service level {#enable-service-restriction}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you configured the VPC service connection.
  1. Navigate to **Object Storage**.
  1. Select the bucket from the list.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/wrench.svg) **Settings**.
  1. Under **Strict mode**, enable **Available only via VPC service connections**.
  1. In the **VPC service connections** field, specify the ID of the service connection you created.
  1. Optionally, enable **Access from console**. This option enables you to access the bucket from the management console even if access is allowed only via VPC service connections. When this option is disabled, you can only access the bucket via the API or CLI.
  1. Click **Save**.

- Yandex Cloud CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Create additional DNS [resource records](../../dns/concepts/resource-record.md) to override the public FQDN of the service to which the connection is created. To do this, enable a special VPC service connection parameter:

      ```bash
      yc vpc private-endpoint update \
        --id <service_connection_ID> \
        --private-dns-records-enabled
      ```

  1. Update the bucket settings by specifying the parameters for access only from VPC service connections:

      ```bash
      yc storage bucket update \
        --name <bucket_name> \
        --enable-private-endpoints true \
        --private-endpoints <service_connection_ID> \
        --private-endpoints-force-cloudconsole-access true
      ```

      Where:
      * `--name`: Bucket name.
      * `--enable-private-endpoints`: Parameter for access to the bucket only from VPC service connections. If you do not set this parameter, the bucket will be accessible from both the public network and VPC service connections.
      * `--private-endpoints`: List of IDs of VPC service connections to allow access from.

        {% note warning %}

        If you do not specify the IDs of VPC service connections, the bucket will not be accessible from anywhere. However, you can still [disable](#disable) the restrictions for access only from VPC service connections.

        {% endnote %}

      * `--private-endpoints-force-cloudconsole-access`: This parameter enables bucket access from the management console even if access is allowed only via VPC service connections. This is an optional parameter. When this option is disabled, you can only access the bucket via the API or CLI.

- API {#api}

  To allow bucket access only from VPC service connections at the service level, use the [update](../../storage/api-ref/Bucket/update.md) REST API method for the [Bucket](../../storage/api-ref/grpc/Bucket/index.md) resource or the [Bucket/Update](../../storage/api-ref/grpc/Bucket/update.md) gRPC API call.

{% endlist %}

### Restoring bucket access from a public network {#disable}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you configured the VPC service connection.
  1. Navigate to **Object Storage**.
  1. Select the bucket from the list.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/wrench.svg) **Settings**.
  1. Under **Strict mode**, disable **Available only via VPC service connections**.
  1. Click **Save**.

- Yandex Cloud CLI {#cli}

  Update the bucket settings:

  ```bash
  yc storage bucket update \
    --name <bucket_name> \
    --enable-private-endpoints false
  ```

  Where:
  * `--name`: Bucket name.
  * `--enable-private-endpoints`: Parameter for access to the bucket only from VPC service connections.

    {% note tip %}

    After you remove the restriction for access only from VPC service connections, the list of service connections provided earlier in the `--private-endpoints` parameter remains in the bucket settings. If you choose to restrict access again, you do not have to provide the list one more time.

    {% endnote %}

- API {#api}

  To allow bucket access only from VPC service connections at the service level, use the [update](../../storage/api-ref/Bucket/update.md) REST API method for the [Bucket](../../storage/api-ref/grpc/Bucket/index.md) resource or the [Bucket/Update](../../storage/api-ref/grpc/Bucket/update.md) gRPC API call.

{% endlist %}

### Server-side copy {#server-side-copy}

For details on [server-side copy](../../storage/operations/objects/copy.md) in buckets with access restricted to VPC service connections, refer to this table:

Source bucket | Target bucket | Condition to initiate server-side copying^1^
--- | --- | ---
Access restricted to VPC service connections | Access restricted to VPC service connections | Request from a service connection listed as allowed for both buckets
Access restricted to VPC service connections | Access from a public network | Request from a service connection listed as allowed for the source bucket
Access from a public network | Access restricted to VPC service connections | Request from a service connection listed as allowed for the target bucket
Access from a public network | Access from a public network | Request from a public network or service connection

^1^ If the client has permissions to read from the source bucket and write to the target bucket.