URLs to whitelist for AWS S3 API endpoints

Question

Hello, we are using IAM role for uploading to S3 buckets using AWS API. Our security team has those urls blocked. We need to provide them a list of all endpoints that boto3 client sdk would be hitting. Is there any list available ?

Thanks

Answer

Hi clouder

I believe you can ask your security team to enable the S3 service endpoints mentioned here -> 
[https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAPI.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAPI.html)
[https://docs.aws.amazon.com/general/latest/gr/s3.html](https://docs.aws.amazon.com/general/latest/gr/s3.html)

Another option would be to create S3 access points which would provide you with a dedicated access point for a relevant bucket -> [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html)

From a security perspective, this might be a better option as then you only have to enable the URLs for the buckets in your environment.

Answer

I believe you need the AWS service endpoint URLs.

This page should assist you here https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints

Also a blog post using ssm https://aws.amazon.com/blogs/aws/new-query-for-aws-regions-endpoints-and-more-using-aws-systems-manager-parameter-store/

There are quite a few :-)

URLs to whitelist for AWS S3 API endpoints

Relevant content