Modernizing Private AWS Connectivity

Private workloads reached Amazon S3 through a Squid proxy tier. The proxies were extra infrastructure to patch, scale and monitor, and they carried critical and high vulnerability findings that kept generating remediation work.

Workloads run in private subnets with no direct internet access. S3 access still had to stay private and controlled. The question was whether the proxy was still the right component on that path.

1. 1.Mapped which workloads depended on the proxy for S3 access.
2. 2.Introduced S3 Interface VPC Endpoints and validated DNS resolution and connectivity from private subnets.
3. 3.Migrated workloads to the endpoint path, then decommissioned the proxy infrastructure tied to S3 access.

• ▸S3 traffic stays private without traversing a proxy tier.
• ▸Endpoint and security-group controls bound which workloads can reach S3.
• ▸Retiring the proxy servers removed the critical/high vulnerability findings associated with them.

• ▸Endpoint configuration managed as infrastructure code alongside the VPC.

• ▸Removed infrastructure that carried critical/high vulnerability findings.
• ▸Simplified the S3 access path, leaving fewer components to patch, scale and monitor.
• ▸Kept S3 connectivity private for workloads without internet access.

• ▸Sometimes the best remediation is to remove the component entirely.
• ▸Managed AWS networking primitives often replace self-managed infrastructure with less operational overhead.