AWS CLI S3 연결 불가

• 인터넷 사용이 불가능한 Private한 환경에 있는 EC2에서 CLI 로 S3에 접근하고자 하는데 연결이 되지 않음
• S3와 연결을 위해 S3 Endpoint의 방화벽을 열어주었는데도 안됨.

root@ip-10-0-143-45:~# aws s3 ls 

• 위 명령어 사용시 무한 로딩 발생
• debug 옵션을 사용하여 원인 분석

root@ip-10-0-143-45:~# aws s3 ls --debug
.
.
.
2025-05-14 04:17:32,825 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): s3.us-east-1.amazonaws.com:443

• Starting new HTTPS connection (1): s3.us-east-1.amazonaws.com:443 에서 로딩 발생
• 해당 도메인에 대하여 nslookup
  • 연결한 Endpoint의 Private IP가 아닌 처음보는 Public IP 가 나옴
  • 원래 Endpoint가 생성되면 Endpoint의 IP가 나옴

root@ip-10-0-143-45:~# nslookup s3.us-east-1.amazonaws.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	s3.us-east-1.amazonaws.com
Address: 52.217.126.xxx
Name:	s3.us-east-1.amazonaws.com
Address: 16.15.200.xxx
Name:	s3.us-east-1.amazonaws.com
Address: 52.217.75.xxx
Name:	s3.us-east-1.amazonaws.com
Address: 52.217.233.xxx
Name:	s3.us-east-1.amazonaws.com
Address: 52.216.218.xxx
Name:	s3.us-east-1.amazonaws.com
Address: 16.15.176.xxx
Name:	s3.us-east-1.amazonaws.com
Address: 52.216.244.xxx
Name:	s3.us-east-1.amazonaws.com
Address: 52.217.43.xxx

• 엔드포인트를 생성한 다른 서비스 예시

root@ip-10-0-143-45:~# nslookup secretsmanager.us-east-1.amazonaws.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	secretsmanager.us-east-1.amazonaws.com
Address: 10.0.187.192

• 원인
  • S3는 VPC 내에서는 Interface Endpoint가 아니라 Gateway용 Endpoint를 사용하여 통신한다.
• Gateway용 엔드포인트 생성 방법
  • VPC → 엔드포인트 → 엔드포인트 생성
  • 이름 지정
  • 유형 : AWS 서비스
  • 서비스에 s3 검색 후 com.amazonaws.us-east-1.s3 선택

• 유형이 Gateway인 엔드포인트 선택

• 네트워크 설정
  • 원하는 VPC 선택
  • S3 Cli 명령어를 쓸 서버가 있는 서브넷의 라우팅 테이블 선택
• 엔드포인트 생성
• nslookup 시 Gateway 유형이라 Interface 처럼 Endpoint의 IP가 나오지는 않음
• root@ip-10-0-143-45:~# nslookup s3.us-east-1.amazonaws.com Server: 127.0.0.53 Address: 127.0.0.53#53 Non-authoritative answer: Name: s3.us-east-1.amazonaws.com Address: 16.15.217.xxx Name: s3.us-east-1.amazonaws.com Address: 52.216.222.xxx Name: s3.us-east-1.amazonaws.com Address: 52.217.164.xxx Name: s3.us-east-1.amazonaws.com Address: 52.217.46.xxx Name: s3.us-east-1.amazonaws.com Address: 3.5.14.xxx Name: s3.us-east-1.amazonaws.com Address: 52.217.230.xxx Name: s3.us-east-1.amazonaws.com Address: 52.217.48.xxx Name: s3.us-east-1.amazonaws.com Address: 54.231.170.xxx
• 이후 s3 ls 사용시 잘 되는 것 확인