Skip to content
Private S3 Artifact Store

Prove

Progress checklist

Overview

Section titled “Overview”

demo.sh prove uses SSM Run Command (no SSH). On the probe EC2 it curls the regional object URL (https://<bucket>.s3.<region>.amazonaws.com/<demo_key>), which goes through that Region’s S3 gateway VPCE.

Do this in both Regions. Keep instance, gateway, and bucket Region matched: a Sydney gateway cannot read the Auckland bucket hostname.

Prove reads via SSM probe and regional S3 gateway Laptop curls the public S3 URL and is denied. SSM Run Command on the probe EC2 curls the same regional hostname through the S3 gateway VPCE and succeeds. prove: SSM curl via gateway vs laptop deny Laptop public curl DENY 403 SSM Run Command ap-southeast-2 consumer VPC Probe EC2 S3 gateway ALLOW S3 primary S3 primary URL demo/see-....txt Match Region: instance + gateway + bucket hostname | Auckland prove needs up-consumer akl

Steps

Section titled “Steps”

Set once:

Terminal window
export AWS_PROFILE=sandbox
PRIMARY="$(jq -r .primary_bucket .lab-state.json)"
REPLICA="$(jq -r .replica_bucket .lab-state.json)"
KEY="$(jq -r .demo_key .lab-state.json)"

  1. Sydney probe (primary via Syd gateway):

    Terminal window
    ./scripts/demo.sh prove syd
    {
      "Status": "Success",
      "Stdout": "private-s3-artifact-store demo object\ncreated_utc=20260904T205809Z\nprimary_bucket=ps3a-artifacts-**ACCOUNT**-syd\nprimary_region=ap-southeast-2\n\nEXIT:0\n",
      "Stderr": ""
    }

  2. Auckland probe (replica via Akl gateway):

    Terminal window
    ./scripts/demo.sh prove akl
    {
      "Status": "Success",
      "Stdout": "private-s3-artifact-store demo object\ncreated_utc=20260904T205809Z\nprimary_bucket=ps3a-artifacts-**ACCOUNT**-syd\nprimary_region=ap-southeast-2\n\nEXIT:0\n",
      "Stderr": ""
    }

  3. Laptop public curl (must fail after allowlist):

    Terminal window
    curl -sS -o /tmp/prove-curl.body -w 'http_code=%{http_code}\n' \
      "https://${PRIMARY}.s3.ap-southeast-2.amazonaws.com/${KEY}"
    head -c 200 /tmp/prove-curl.body; echo
    http_code=403
    <?xml version="1.0" encoding="UTF-8"?>
    <Error><Code>AccessDenied</Code><Message>Access Denied</Message>...</Error>

Verify

Section titled “Verify”

  1. Confirm both consumers and the published key:

    Terminal window
    jq '{demo_key,
      syd: {instance: .consumers.syd.instance_id, vpce: .consumers.syd.s3_vpce_id},
      akl: {instance: .consumers.akl.instance_id, vpce: .consumers.akl.s3_vpce_id}}' .lab-state.json
    {
      "demo_key": "demo/see-20260904T205809Z.txt",
      "syd": {
        "instance": "i-01d741261020acb67",
        "vpce": "vpce-0e5bfd92d3a7c0f29"
      },
      "akl": {
        "instance": "i-07d5eaa611269b0fa",
        "vpce": "vpce-03e2d0531f4aa10bc"
      }
    }

  2. Assert Syd Success + EXIT:0:

    Terminal window
    ./scripts/demo.sh prove syd \
      | jq '{Status, has_body: (.Stdout | contains("private-s3-artifact-store")), exit_line: (.Stdout | capture("EXIT:(?<e>[0-9]+)") | .e)}'
    {
      "Status": "Success",
      "has_body": true,
      "exit_line": "0"
    }

  3. Assert Akl Success + EXIT:0:

    Terminal window
    ./scripts/demo.sh prove akl \
      | jq '{Status, has_body: (.Stdout | contains("private-s3-artifact-store")), exit_line: (.Stdout | capture("EXIT:(?<e>[0-9]+)") | .e)}'
    {
      "Status": "Success",
      "has_body": true,
      "exit_line": "0"
    }

Next

Section titled “Next”

Teardown