✓ Human-authored analysis; AI used for formatting and proofreading.

One of the confident statements on r/aws: "We route all S3 traffic through a VPC endpoint, so our data stays on the private network." VPC endpoints do keep traffic off the public internet. But the confidence creates a blind spot.

The Default Policy Problem

When you create a VPC gateway endpoint for S3, AWS attaches a default policy:

{ "Statement" : [ { "Effect" : "Allow" , "Principal" : "*" , "Action" : "*" , "Resource" : "*" } ] }

Enter fullscreen mode

Exit fullscreen mode

Any principal on the VPC can reach ANY S3 bucket in ANY AWS account. Not just your buckets or buckets in your account. Any bucket, anywhere, that allows access from the calling principal.

The endpoint restricts the network path but not the destination . A compromised EC2 instance on your VPC can exfiltrate data to an attacker-controlled S3 bucket in a different account, and the traffic never touches the internet.…