Virtual Private Cloud:Access Alibaba Cloud services from a VPC over a private network

Create a gateway endpoint and configure an authorization policy

The VPC where the gateway endpoint is enabled, the authorized bucket, and the user that accesses OSS from within the VPC can belong to different Alibaba Cloud accounts.

Note that gateway endpoints are supported only in some regions.

1. Create a gateway endpoint and configure an endpoint policy.

   1. Go to the VPC console, choose Endpoints > Gateway Endpoints, and then click Create Endpoint.

   2. Select a region, enter a name for the endpoint, and make sure that the endpoint type is Gateway Endpoint.

   3. For Endpoint Service, select Select Service and then select the endpoint service whose Service Resource Type is OSS.

   4. Select a VPC and a route table.

      After the gateway endpoint is created, the system automatically adds a custom route entry to the selected route table. The destination CIDR block of the route entry is a system prefix list that contains the VIP CIDR block of OSS in the region, and the next hop is the gateway endpoint.

   5. Configure an endpoint policy. The syntax is the same as the policy language of Resource Access Management (RAM).

      Policy example

      The following example policy indicates that only the user with the account ID 1746xxxxxx is allowed to perform OSS operations on the bucket named examplebucket from the VPC.

      { "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "oss:*", "Resource": ["acs:oss:*:*:examplebucket", "acs:oss:*:*:examplebucket/*"], "Principal": ["1746xxxxxx"] } ] }

   6. After the gateway endpoint is created, you can find a route entry that is automatically added by the system in the custom route entries of the associated route table. The next hop of the route entry points to the gateway endpoint.

2. Configure a bucket policy for OSS.

   1. Go to the OSS console, click Buckets, and then click the name of the bucket for which you want to configure an authorization policy.

   2. In the navigation pane on the left, choose Access Control > Bucket Policy. Click Add Policy By Syntax and then click Edit.

   3. Configure a bucket policy. The syntax is the same as the policy language of RAM.

      Policy example

      The following example policy indicates that:

      1. Policy 1: Denies all accounts from accessing the bucket named examplebucket and performing OSS operations from VPCs other than the VPC with the ID vpc-bp******.

         For a list of OSS actions, see RAM Policy. We recommend that you do not set Action to * in a Deny policy. Otherwise, the bucket owner cannot access the bucket in the OSS console.

      2. Policy 2: Allows only the user with the account ID 1746xxxxxx to access the bucket named examplebucket and perform OSS operations from the VPC with the ID vpc-bp******.

      { "Version": "1", "Statement": [ { "Effect": "Deny", "Action": ["oss:ListObjects","oss:GetObject","oss:PutObject","oss:DeleteObject"], "Resource": ["acs:oss:*:*:examplebucket", "acs:oss:*:*:examplebucket/*"], "Principal": ["*"],	"Condition": { "StringNotEquals": { "acs:SourceVpc": [ "vpc-bp******" ] }	} },{ "Effect": "Allow", "Action": ["oss:*"], "Resource": ["acs:oss:*:*:examplebucket", "acs:oss:*:*:examplebucket/*"], "Principal": ["1746xxxxxx"],	"Condition": { "StringEquals": { "acs:SourceVpc": [ "vpc-bp******" ] }	} } ] }

   4. After you configure the policy, click Save.

3. Verify the access policy.

   Note: If a RAM user is used to access OSS, you must grant the RAM user permissions to perform operations on the relevant OSS bucket. Otherwise, access may fail.

   1. Access the authorized bucket from the authorized VPC using an authorized account. The access attempt is successful.

   2. If the account, VPC, or bucket is not authorized, the access attempt fails.

Modify the access policy

You can modify the access policy to adjust the scope of authorized VPCs, buckets, or accounts.

• To adjust the scope of authorized VPCs, go to the OSS console, click Buckets, and then click the name of the destination bucket. In the navigation pane on the left, choose Access Control > Bucket Policy. Modify the Condition field in the existing authorization policy to add or remove VPCs that can access the bucket.

• To adjust the scope of authorized buckets:

  1. Go to the VPC console, choose Endpoints > Gateway Endpoints, and click the ID of the destination gateway endpoint. On the Endpoint Policy tab, modify the Resource field in the existing authorization policy to add or remove buckets that the VPC can access.

  2. Go to the OSS console, click Buckets, and then click the name of the destination bucket. In the navigation pane on the left, choose Access Control > Bucket Policy. Modify the Resource field in the existing authorization policy to add or remove bucket resources that can be accessed. If multiple buckets are involved, you must perform this operation for each bucket.

• To adjust the scope of authorized accounts:

  Note: If a RAM user is used to access OSS, you must grant the RAM user permissions to perform operations on the relevant OSS bucket. Otherwise, access may fail.

  1. Go to the VPC console, choose Endpoints > Gateway Endpoints, and click the ID of the destination gateway endpoint. On the Endpoint Policy tab, modify the Principal field in the existing authorization policy to add or remove accounts that can access the bucket from within the VPC.

  2. Go to the OSS console, click Buckets, and then click the name of the destination bucket. In the navigation pane on the left, choose Access Control > Bucket Policy. Modify the Principal field in the existing authorization policy to add or remove accounts that can access the bucket from within the VPC. If multiple buckets are involved, you must perform this operation for each bucket.

Associate or dissociate a route table

You can associate a gateway endpoint with or dissociate a gateway endpoint from a route table to control which vSwitches in the VPC can access Alibaba Cloud services through the gateway endpoint.

1. Go to the VPC console, choose Endpoints > Gateway Endpoints, and click the ID of the destination gateway endpoint.

2. On the Associated Route Tables tab:

   1. To associate a new route table, click Associate Route Table. After the association is complete, you can find a route entry that is automatically added by the system in the custom route entries of the associated route table. The next hop of the route entry points to the gateway endpoint.

   2. To dissociate an existing route table, click Dissociate to the right of the associated route table. After the route table is dissociated, the route entry added by the system is automatically removed.

Delete a gateway endpoint

Before you delete a gateway endpoint, you must dissociate all associated route tables.

1. Dissociate all associated route tables.

2. Go to the VPC console, choose Endpoints > Gateway Endpoints, and click Delete to the right of the destination gateway endpoint.

3. (Optional) The bucket policy remains in the bucket, which prevents other VPCs from accessing the bucket. To adjust the policy, go to the OSS console, click Buckets, and then click the name of the destination bucket. In the navigation pane on the left, choose Access Control > Bucket Policy to modify or delete the policy that allows access only from the specified VPC.