Question 19695 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

How can I implement AWS QLDB standard mode with VPC endpoint?

AWS recommends QLDB Standard permissions mode instead of Allow_all in order to allow least privilege access for resources which need to run operations on QLDB.

Reference: https://docs.aws.amazon.com/qldb/latest/developerguide/getting-started-standard-mode.html

However, If you are using VPC endpoints to have a private channel between these resources and QLDB, according to the following documentation only the SendCommand action is allowed supported by VPC endpoint: "This policy example specifies only the SendCommand action because it’s the only QLDB action that currently supports interface endpoints."

Reference: https://docs.aws.amazon.com/qldb/latest/developerguide/vpc-endpoints.html

That being said, it looks like is not possible to implement QLDB standard mode through VPC endpoint.

Is that assumption right or is it possible to have QLDB standard mode + VPC endpoint?

Tags:

2

Answers


  1. 0

    Thanks for your feedback on the doc. QLDB standard mode + VPC endpoint is supported. You are able to restrict permissions to run PartiQL commands on QLDB resources with IAM actions in standard mode, e.g. qldb:PartiQLCreateTable.

    Login or Signup to reply.
  2. 0

    I’ve updated a little POC to show QLDB in standard mode working with a VPC endpoint. You can find the repo here – https://github.com/AWS-South-Wales-User-Group/qldb-vpc

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search