title: How to limit access to an S3 bucket to a specific VPC while allowing console access
body: <p>I am setting up a selection of S3 buckets and wish to restrict access to them to a VPC while still allowing access to the buckets from the AWS console.</p>
  
  <p>As proposed <a href="https://stackoverflow.com/questions/25539057/restricting-s3-bucket-access-to-a-vpc">here</a> I have created an S3 endpoint and also added it to the main routing table. The policy on the endpoint allows full access to all resources.</p>
  
  <p>I have created an S3 policy (see below) and added it to the bucket. As soon as I save the policy, access to the bucket from the console is no longer possible. </p>
  
  <p>I have also tried to specifically add a user to the condition "StringNotEquals" in the form of "aws:username": "user1", to no avail.</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Id": "Policy-S3-Bucket-myBucket",
  "Statement": [
  
      {
          "Sid": "Access-via-VPC-only",
          "Principal": "*",
          "Action": "s3:*",
          "Effect": "Deny",
          "Resource": [
              "arn:aws:s3:::myBucket",
              "arn:aws:s3:::myBucket/*"
          ],
          "Condition": {
              "StringNotEquals": {
                  "aws:sourceVpc": "vpc-01c9d66c12345"
              }
          }
      },
      {
          "Sid": "Allow-console-access",
          "Action": [
            "s3:*"
          ],
          "Effect": "Allow",
          "Resource": [
            "arn:aws:s3:::myBucket",
            "arn:aws:s3:::myBucket/*"
        ],
          "Principal": {
            "AWS": [
              "arn:aws:iam::&lt;account-id&gt;:user/user1", "arn:aws:iam::&lt;account-id&gt;:user/user2"
            ]
          }
        }
  ]
  }
  </code></pre>
  
  <p>The expected result would be that the S3 bucket is only accessible by the aforementioned VPC and via the AWS console.</p>
  
  <p>The actual result is: </p>
  
  <p>The bucket overview shows an "Error: Access Denied" and the permissions page(public access settings) shows: "You don't have access to view this configuration. Contact your account administrator to request access."</p>
  
  <p>I have to login using  the root user and delete the policy to regain access to the bucket.</p>