Internetwork traffic privacy
This topic describes how Amazon S3 secures connections from the service to other locations.
Traffic between service and on-premises clients and applications
The following connections can be combined with Amazon PrivateLink to provide connectivity between your private network and Amazon:
An Amazon Site-to-Site VPN connection. For more information, see What is Amazon Site-to-Site VPN?
An Amazon Direct Connect connection. For more information, see What is Amazon Direct Connect?
Access to Amazon S3 via the network is through Amazon published APIs. Clients must support Transport Layer Security (TLS) 1.2. We recommend TLS 1.3. Clients must also support cipher suites with Perfect Forward Secrecy (PFS), such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). Most modern systems such as Java 7 and later support these modes. Additionally, you must sign requests using an access key ID and a secret access key that are associated with an IAM principal, or you can use the Amazon Security Token Service (STS) to generate temporary security credentials to sign requests.
Traffic between Amazon resources in the same Region
A virtual private cloud (VPC) endpoint for Amazon S3 is a logical entity within a VPC that allows connectivity only to Amazon S3. The VPC routes requests to Amazon S3 and routes responses back to the VPC. For more information, see VPC Endpoints in the VPC User Guide. For example bucket policies that you can use to control S3 bucket access from VPC endpoints, see Controlling access from VPC endpoints with bucket policies.