<p>You need to use...</p>

<ul>
<li>the Internet, from your data center, to access S3 directly (not via the endpoint) or</li>
<li>an AWS DirectConnect connection to access S3 directly (not via the endpoint) or</li>
<li>an HTTP proxy server inside this VPC to access S3 (via the endpoint)</li>
</ul>

<p>...because S3 endpoints are not designed to be used across VPN connections.  They are only accessible from instances in the VPC where they exist.</p>

<blockquote>
  <p>Endpoint connections cannot be extended out of a VPC. Resources on the other side of a VPN connection, VPC peering connection, AWS Direct Connect connection, or ClassicLink connection in your VPC cannot use the endpoint to communicate with resources in the endpoint service.</p>
  
  <p><a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html#vpc-endpoints-limitations" rel="nofollow noreferrer">https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html#vpc-endpoints-limitations</a></p>
</blockquote>

CC BY-SA 4.0
2018-12-17T22:13:39.340Z
If I go with HTTP proxy server inside this VPC, can I still access rest of the VPC as it is ? or I need to whitelist it in proxy server ?
rp346
CC BY-SA 4.0
2018-12-15T00:26:56.977Z
2018-12-15T00:26:56.977Z
Michael - sqlbot
<p>I am trying to access S3 files from non-EC2 machine. non-EC2 machine is connected to VPC over VPN, also can reach to other hosts in VPC.</p>

<ul>
<li>Created VPC Endpoint for S3</li>
<li>Main routing table of VPC has route for S3 pointing to VPCe (<code>pl-68a54001 (com.amazonaws.us-west-2.s3, 54.231.160.0/19, 52.218.128.0/17, 52.92.32.0/22)</code>)</li>
<li>S3 bucket has <strong>Static website hosting</strong> enabled</li>
<li>S3 bucket has policy for accessing files from VPCe (<a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html</a>)</li>
</ul>

<p>I am able to download (<code>wget</code>) file from S3 to EC2 in the VPC. When I try to do same (<code>wget</code>) from non-EC2 (which is in Data Centre), I get timeout.</p>

<p>Anyone know what I need to do to get this working ?</p>

CC BY-SA 4.0
2019-07-18T02:50:35.477Z
This is exactly what I'm trying to do..
monkut
<amazon-web-services><amazon-s3><aws-vpc>
Access S3 files from Datacenter over VPN to VPC
rp346
# Access S3 files from Datacenter over VPN to VPC

(Asked by: username_0 on 2018-12-14)

I am trying to access S3 files from non-EC2 machine. non-EC2 machine is connected to VPC over VPN, also can reach to other hosts in VPC.

* Created VPC Endpoint for S3
* Main routing table of VPC has route for S3 pointing to VPCe (`pl-68a54001 (com.amazonaws.us-west-2.s3, 54.231.160.0/19, 52.218.128.0/17, 52.92.32.0/22)`)
* S3 bucket has **Static website hosting** enabled
* S3 bucket has policy for accessing files from VPCe (<https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html>)

I am able to download (`wget`) file from S3 to EC2 in the VPC. When I try to do same (`wget`) from non-EC2 (which is in Data Centre), I get timeout.

Anyone know what I need to do to get this working ?

**Tags:** amazon-web-services, amazon-s3, aws-vpc

> **Comments:**
> **username_1**: This is exactly what I'm trying to do..  

---

## 1 answers

### Answer by username_2 on 2018-12-15. Score: 4 | Accepted answer

You need to use...

* the Internet, from your data center, to access S3 directly (not via the endpoint) or
* an AWS DirectConnect connection to access S3 directly (not via the endpoint) or
* an HTTP proxy server inside this VPC to access S3 (via the endpoint)

...because S3 endpoints are not designed to be used across VPN connections. They are only accessible from instances in the VPC where they exist.

> Endpoint connections cannot be extended out of a VPC. Resources on the other side of a VPN connection, VPC peering connection, AWS Direct Connect connection, or ClassicLink connection in your VPC cannot use the endpoint to communicate with resources in the endpoint service.
>
> <https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html#vpc-endpoints-limitations>

> **Comments:**
> **username_0**: If I go with HTTP proxy server inside this VPC, can I still access rest of the VPC as it is ? or I need to whitelist it in proxy server ?  

---

