title: How do you get a VPC Endpoint to work in a Docker container?
body: <p>I'm not able to get the AWS CLI to download a text file from S3 in a Docker container. There is a VPC setup with a VPC Endpoint approved on the S3 policy:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "DenyUnEncryptedObjectUploads",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::secret-store/*",
        "Condition": {
          "StringNotEquals": {
            "s3:x-amz-server-side-encryption": "AES256"
          }
        }
      },
      {
        "Sid": " DenyUnEncryptedInflightOperations",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::secret-store/*",
        "Condition": {
          "Bool": {
            "aws:SecureTransport": "false"
          }
        }
      },
      {
        "Sid": "Access-to-specific-VPCE-only",
        "Effect": "Deny",
        "Principal": "*",
        "Action": [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject"
        ],
        "Resource": "arn:aws:s3:::secret-store/*",
        "Condition": {
          "StringNotEquals": {
            "aws:sourceVpce": "vpce-de7893b7"
          }
        }
      }
    ]
  }
  </code></pre>
  
  <p>I'm using a Dockerfile that installs the AWS CLI and calls an entrypoint script:</p>
  
  <pre><code>FROM java:8
  RUN apt-get update &amp;&amp; \
      apt-get -y install python curl unzip &amp;&amp; cd /tmp &amp;&amp; \
      curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" \
      -o "awscli-bundle.zip" &amp;&amp; \
      unzip awscli-bundle.zip &amp;&amp; \
      ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws &amp;&amp; \
      rm awscli-bundle.zip &amp;&amp; rm -rf awscli-bundle
  
  COPY entrypoint.sh /entrypoint.sh
  
  ENTRYPOINT ["/entrypoint.sh"]
  </code></pre>
  
  <p>The entrypoint script sets the AWS CLI config file and calls <code>aws s3 cp s3://bucket/file.txt -</code>:</p>
  
  <pre><code>#!/bin/bash
  
  mkdir ~/.aws
  
  echo '[default]
  aws_access_key_id=
  aws_secret_access_key=
  output=json
  region=us-west-2' &gt; ~/.aws/config
  
  aws --version
  
  aws s3 cp s3://secret-store/test.txt -
  </code></pre>
  
  <p>When I run the entrypoint script from the EC2 CLI, I get the expected authorized response:</p>
  
  <pre><code>[ec2-user@ip-10-0-1-86 ~]$ ./entrypoint.sh
  mkdir: cannot create directory ‘/home/ec2-user/.aws’: File exists
  aws-cli/1.11.22 Python/2.7.5 Linux/3.10.0-514.el7.x86_64 botocore/1.4.79
  Hello secure VPC world!
  </code></pre>
  
  <p>But I get a <code>download failed (Forbidden)</code> error when I run the same script from a Docker image on the same host that it was successful:</p>
  
  <pre><code>[ec2-user@ip-10-0-1-86 ~]$ docker build . -t test &amp;&amp; docker run test
  Sending build context to Docker daemon 15.89 MB
  Step 1 : FROM java:8
   ---&gt; 861e95c114d6
  Step 2 : RUN apt-get update &amp;&amp;     apt-get -y install python curl unzip &amp;&amp; cd /tmp &amp;&amp;     curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip"     -o "awscli-bundle.zip" &amp;&amp;     unzip awscli-bundle.zip &amp;&amp;     ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws &amp;&amp;     rm awscli-bundle.zip &amp;&amp; rm -rf awscli-bundle
   ---&gt; Using cache
   ---&gt; c948b9caeaae
  Step 3 : COPY entrypoint.sh /entrypoint.sh
   ---&gt; Using cache
   ---&gt; 9c1774cc5d57
  Step 4 : ENTRYPOINT /entrypoint.sh
   ---&gt; Running in 98179b1b7172
   ---&gt; d8f12456a198
  Removing intermediate container 98179b1b7172
  Successfully built d8f12456a198
  aws-cli/1.11.22 Python/2.7.9 Linux/3.10.0-514.el7.x86_64 botocore/1.4.79
  download failed: s3://secret-store/test.txt to - An error occurred (403) when calling the HeadObject operation: Forbidden
  </code></pre>
  
  <p>Anyone know why I'm getting a Forbidden response in a docker container that is running on the same host I'm getting a success response from?</p>