docs: Example policy for VPC endpoint needs Allow statement; S3 endpoint should be type 'Gateway' #1197
Conversation
…dpoint to type 'Gateway'
alexmbird
changed the title
|
This PR has been automatically marked as stale because it has been open 30 days |
|
Definitely not stale. @antonbabenko could you or another maintainer take a look? |
| private_dns_only_for_inbound_resolver_endpoint = false | ||
| } | ||
| tags = { Name = "s3-vpc-endpoint" } | ||
| type = "Gateway" |
There was a problem hiding this comment.
I found this PR when trying to figure out how to set an S3 gateway endpoint, but I think the option key here is service_type, not type:
| type = "Gateway" | |
| service_type = "Gateway" |
There was a problem hiding this comment.
This actually fixed my problem and unblocked me.. and worked!
I had tried endpoint_type and vpc_endpoint_type to no avail, really appreciate your comment here!
|
This PR has been automatically marked as stale because it has been open 30 days |
|
This PR has been automatically marked as stale because it has been open 30 days |
4 participants
Description
I've been troubleshooting a problem with an EKS cluster running in a VPC created by terraform-aws-vpc. Most of my setup was cribbed from your complete example. Attempts to pull images from ECR in the same region were consistently denied while those in other regions worked fine.
AWS Support managed to identify the problem. It was that ECR endpoints created using the
generic_endpoint_policyfrom the example lack anyAllowstatement to permit access. Allow statements aren't implicit in IAM policies so this defaulted to denying all requests.Calls to ECR in the same region therefore failed. Ones to ECR in other regions went out via my NAT gateway instead of using the local endpoint, so confusingly they still worked fine.
The PR fixes the issue by adding the missing
Allowstatement. AWS support have also advised me S3 endpoints should typically be set as typeGateway, so I've modified the example to do this too.Motivation and Context
It solves the problem of ECR images failing to pull via VPC endpoints created following the example bundled with terraform-aws-vpc.
Breaking Changes
No
How Has This Been Tested?
Please describe how you tested your changes
pre-commit run -aon my pull request