Using the AWS PrivateS3 Feature

Go to Gateway > New Gateway to launch an Aviatrix Gateway. Specify the Gateway Name, Access Account Name, Region, VPC ID, Public Subnet, and Gateway Size. Leave all other fields as default.

Select the region where you want the S3 buckets to be explicitly allowed or denied access through PrivateS3.

PrivateS3 automatically scans the S3 buckets owned by the Access Accounts. Create one Access Account if you have not done so.

Each AWS S3 bucket has a unique FQDN name. For example, if a full URL to access a file in S3 is https://avx-backup.s3-us-west-2.amazonaws.com/init.txt, then the bucket’s FQDN name is either avx-backup.s3-us-west-2.amazonaws.com or avx-backup.s3.us-west-2.amazonaws.com.

Click Enable. If PrivateS3 has been enabled, use this step to update changes in Source CIDR Range or Access Accounts.

Once PrivateS3 is enabled, Controller creates an AWS NLB and attaches the PrivateS3 gateway to it. The NLB serves as load balancer to forward S3 HTTPS requests to the gateways.

Once PrivateS3 is enabled, you can repeat the previous steps to create more Aviatrix Gateways in the same VPC and attach them to the NLB.

Once PrivateS3 is enabled on the selected accounts, the Controller scans every 30 minutes for S3 buckets of the selected accounts in the region where the Aviatrix PrivateS3 gateway is deployed.

When new S3 buckets are discovered, an email is sent to the Controller admin. The admin should log in to the Controller, and go to Security > PrivateS3 > Step 4 to take actions on the new buckets. The actions are Allow or Deny.

Filter on S3 buckets with policy New. Change it to either Allow or Deny.

You can change all buckets to Allow All or Deny All.

When PrivateS3 is enabled, the Aviatrix Controller creates an AWS Network Load Balancer (NLB) and attaches an Aviatrix gateway to it. More Aviatrix Gateways can be launched and attached to this NLB. The NLB front ends the pool of Aviatrix gateways and distributes S3-related HTTPS requests to the attached gateways.

The View displays relevant data for troubleshooting and visibility.

Create a private zone on your on-prem DNS server so that all S3 bucket names resolve to the PrivateS3 private IP address displayed from Step 2 in the "S3 Bucket FQDN Name Resolution IP" field. This IP address must be reachable from on-prem either by Direct Connect or VPN over Internet.

Depending on how application invokes S3 function, for example, by using "wget", "curl", "aws s3", or "aws2 s3", the generated FQDN name for the S3 object access may be different. There are three formats.

You may need to create a private zone for each region and domain name format. For example, create a zone with domain name s3.us-west-2.amazonaws.com, another zone with domain name s3-us-west-2.amazonaws.com.

PrivateS3 does not require a S3 endpoint, however, S3 endpoints in the VPC where PrivateS3 gateways are deployed helps forwarding traffic to S3 services without routing through the Internet. Configuring an S3 endpoint is outside the scope of the PrivateS3 workflow. Log into the AWS Console to create an S3 endpoint.

When you want to scale-out and add more gateways to the pool, follow these steps.

This completes the configuration needed to add a new gateway to the pool.

This short Aviatrix blog post provides more information on privateS3.