S3 Access Points

When dozens of applications, teams, and accounts all use one large shared bucket (a data lake is the classic case), the single bucket policy becomes a sprawling, fragile document that every change risks breaking. S3 Access Points fix this: each consumer gets its own named endpoint into the bucket, with its own dedicated access policy and optional VPC-only restriction. You manage many small, purpose-scoped policies instead of one monolith.

• A standard access point is Regional and bound to one bucket in the same Region. It has its own hostname and ARN, e.g. finance-ap-<account>.s3-accesspoint.<region>.amazonaws.com.
• An access point can be Internet-facing or VPC-only — the latter refuses any request that doesn’t arrive through a specified VPC.
• Multi-Region Access Points (MRAP) are global: one endpoint that routes each request to the nearest bucket among a replicated set, with automatic failover.

graph TD
subgraph BKT["Shared bucket: company-data-lake"]
  DATA["Objects: /finance/*  /analytics/*  /partner/*"]
end
FIN["Access Point: finance-ap (policy: RW on /finance/*)"] --> DATA
ANA["Access Point: analytics-ap (policy: read-only, VPC-only)"] --> DATA
PART["Access Point: partner-ap (policy: read /partner/*, cross-account)"] --> DATA
FINU(("Finance app")) --> FIN
ANAU(("Analytics VPC")) --> ANA
PARTU(("Partner account")) --> PART
DATA -.->|"bucket policy delegates to access points"| DELEGATE["Bucket policy: 1 line, allow via any AP"]
classDef ap fill:#e8f0fe,stroke:#3b82f6,stroke-width:2px,color:#173a70
classDef bucket fill:#eaf7ec,stroke:#2e8b3d,stroke-width:2px,color:#1a3d20
class FIN,ANA,PART ap
class DATA bucket

Standard access points are free — requests through them are billed at the normal S3 rate. Multi-Region Access Points add a small per-GB routing/data-processing charge on top of standard request, storage, and replication costs. S3 Object Lambda Access Points additionally bill for the Lambda invocations and data returned.

• Trigger: “large shared bucket / data lake with many applications, each needing different, least-privilege access” → S3 Access Points, one per consumer.
• For an access point to work, the bucket policy must delegate to access points (an s3:DataAccessPointAccount condition) — then the access point policy does the fine-grained allow. The request must be permitted by both, plus the caller’s IAM policy.
• VPC-only access points are the clean way to guarantee a dataset is reachable only from inside a given VPC, without writing aws:SourceVpce conditions by hand.
• Multi-Region Access Points = “single global endpoint, route users to the closest copy, fail over automatically” — pair with Cross-Region Replication and, for writes, replication with two-way / active-active rules.
• S3 Object Lambda Access Points run your Lambda on the object as it’s retrieved — redact PII, resize images, convert formats — without storing a second copy.
• Access point names are account- and Region-scoped, not global like bucket names.