how to allow AWS Textract access to a protected S3 bucket

Question

I have bucket policy which allows access only from a VPC:

{
  "Version": "2012-10-17",
  "Id": "aksdhjfaksdhf",
  "Statement": [
    {
      "Sid": "Access-only-from-a-specific-VPC",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::zzzz",
        "arn:aws:s3:::zzzz/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:SourceVpc": "vpc-xxxx"
        }
      }
    }
    ]
}

I'd like to allow traffic coming from AWS Textract to this bucket as well. I've tried various methods but because of the absolute precedence of 'explicit deny' (which I require), I cannot make it work.

Is there a different policy formulation or a different method altogether to restrict the access to this S3 Bucket to traffic from the VPC AND from Textract service exclusively?

Answer 1

This will not be possible.

In general, it's a good idea to avoid Deny policies since they override any Allow policy. They can be notoriously hard to configure correctly.

One option would be to remove the Deny and be very careful in who is granted Allow access to the bucket.

However, if this is too hard (eg Admins are given access to all buckets by default), then a common practice is to move sensitive data to an S3 bucket in a different AWS Account and only grant cross-account access to specific users.