Virtual Private Cloud:Access Alibaba Cloud services from a VPC over a private network

Create a gateway endpoint and configure a policy

The VPC where you create the gateway endpoint, the authorized bucket, and the user that accesses OSS from the VPC can belong to different Alibaba Cloud accounts.

Gateway endpoints are supported only in some regions.

1. Create a gateway endpoint and configure an endpoint policy.

   1. On the VPC console - Gateway Endpoint, click Create Endpoint.

   2. Select a region, enter an endpoint name, and set the endpoint type to Gateway Endpoint.

   3. For Endpoint Service, select Alibaba Cloud Services and select OSS.

   4. Select a VPC and select a route table.

      Once created, the system adds a custom route in that route table pointing to the system prefix list that contains OSS regional VIP CIDR. The next hop is the gateway endpoint.

   5. Configure an endpoint policy. The syntax is the same as the permission policy language of Resource Access Management (RAM).

      Policy example

      The following example policy allows only the user with the Account ID 1746xxxxxx to perform OSS operations on the bucket named examplebucket from the VPC.

      {
        "Version": "1",
        "Statement":
          [
            {
              "Effect": "Allow",
              "Action": "oss:*",
              "Resource": ["acs:oss:*:*:examplebucket",
                           "acs:oss:*:*:examplebucket/*"],
              "Principal": ["1746xxxxxx"]
            }
          ]
      }

   6. After the endpoint is created, you can find a system-added route entry in the custom route entries of the associated route table. The next hop is the gateway endpoint.

2. Configure a bucket policy for OSS.

   1. Go to OSS console - Buckets and click the name of the target bucket.

   2. In the left navigation pane, select Permission Control > Bucket Policy, click Add by Syntax, and then click Edit

   3. Configure a bucket policy. The syntax is the same as the RAM access policy language.

      Example

      The example policy has the following effects:

      1. Policy 1: Denies all accounts access to the bucket examplebucket and to OSS operations from any VPC other than the VPC whose ID is vpc-bp******.

         For a list of OSS actions, see RAM Policy. Do not set Action to * in a Deny policy. Otherwise, the bucket owner cannot access the bucket in the OSS console.

      2. Policy 2: Allows only the account ID 1746xxxxxx to access the bucket examplebucket and perform OSS operations from the VPC whose ID is vpc-bp******.

      {
        "Version": "1",
        "Statement":
          [
            {
              "Effect": "Deny",
              "Action": ["oss:ListObjects","oss:GetObject","oss:PutObject","oss:DeleteObject"],
              "Resource": ["acs:oss:*:*:examplebucket",
                           "acs:oss:*:*:examplebucket/*"],
              "Principal": ["*"],
      	"Condition": {
      	  "StringNotEquals": {
                  "acs:SourceVpc": [
      	      "vpc-bp******"
      	    ]
      	  }
      	}
            },{
              "Effect": "Allow",
              "Action": ["oss:*"],
              "Resource": ["acs:oss:*:*:examplebucket",
                           "acs:oss:*:*:examplebucket/*"],
              "Principal": ["1746xxxxxx"],
      	"Condition": {
      	  "StringEquals": {
                  "acs:SourceVpc": [
      	      "vpc-bp******"
      	    ]
      	  }
      	}
            }
          ]
      }

   4. After configuring the policy, click Save.

3. Verify the access policies.

   Note: If a RAM user accesses OSS, you must grant the RAM user the permissions to perform operations on the specified OSS bucket. Otherwise, the access request fails.

   1. When you use an authorized account to access the authorized bucket from the authorized VPC, the access request succeeds.

   2. If the account, VPC, or bucket is not authorized, the access request fails.

Modify the policy

You can modify the policy to adjust the scope of authorized VPCs, buckets, or accounts.

• To modify which VPCs are authorized to access a bucket, go to the OSS console - Buckets page and click the bucket name. In the left navigation pane, choose Permission Control > Bucket Policy. Modify the Condition field in the policy to add or remove VPCs.

• To modify the scope of authorized buckets:

  1. Go to the VPC console - Gateway Endpoint page and click the ID of the destination gateway endpoint. On the Endpoint Policy tab, modify the Resource field in the authorization policy to control which buckets the VPC can access.

  2. Go to the OSS console - Buckets page and click the name of the target bucket. In the left navigation pane, choose Permission Control > Bucket Policy. Modify the Resource field in the existing authorization policy to add or remove bucket resources. If multiple buckets are involved, you must perform this operation for each bucket.

• To modify the scope of authorized accounts:

  Note: If a RAM user accesses OSS, you must grant the RAM user the required permissions to perform operations on the OSS bucket. Otherwise, the access request fails.

  1. Go to the VPC console - Gateway Endpoint page and click the target gateway endpoint ID. On the Endpoint Policy tab, modify the Principal field in the policy to add or remove accounts that are allowed to access the Bucket from the VPC.

  2. Go to the OSS console - Buckets and click the name of the destination bucket. In the navigation pane on the left, choose Permission Control > Bucket Policy. Modify the Principal field in the existing authorization policy to add or remove accounts that can access the bucket from the VPC. If you are configuring multiple buckets, you must repeat this operation for each bucket.

Associate or dissociate a route table

You can associate a gateway endpoint with or dissociate a gateway endpoint from a route table to control which vSwitches in the VPC can access Alibaba Cloud services through the gateway endpoint.

1. Go to the VPC console - Gateway Endpoint page, and click the target gateway endpoint instance ID.

2. On the Associated Route Tables tab:

   1. To associate a new route table, click Associate with Route Table. The system automatically adds a route to its custom route entries with the next hop being the gateway endpoint.

   2. To dissociate a route table, click Disassociate to the right of the route table. When the route table is dissociated, the system automatically removes the corresponding system route.

Delete a gateway endpoint

Before deleting a gateway endpoint, you must dissociate all route tables.

1. Dissociate all route tables.

2. Go to the VPC console - Gateway Endpoint in the VPC console, find the target gateway endpoint instance, and click Delete.

3. (Optional) The bucket policy remains in effect and may prevent other VPCs from accessing the bucket. To modify the policy, go to the OSS console - Buckets, click the name of the target bucket. In the left navigation pane, select Permission Control > Bucket Policy to modify or delete the policy that restricts access to a VPC.