AccessControl property - s3 bucket - amazon-web-services

Question

We have set following options amidst creation of bucket:
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
to get below restriction for any user trying to change this option:
We have also added below option:
AccessControl: Private
where possible values are: Private, PublicRead, PublicReadWrite, AuthenticatedRead, LogDeliveryWrite, BucketOwnerRead, BucketOwnerFullControl, or AwsExecRead
This is a single zone VPC:
1) What is the meaning of Private vs PublicRead?
2) EC2 is created within VPC(by default). Is bucket created outside VPC? in public domain... Where is bucket created?

Answer 1

Private means that only owner has access to that resource, whether it is bucket or object, PublicRead means that resource owner still has full control but allUsersGroup, which means everyone, whether it is IAM user or not has read access to the resource. Both Private and PublicRead specify predefined set of grants or so called canned ACLs.
S3 bucket is not created in your VPC, it lives in AWS plane which is not part of your VPC. So by default, when you make S3 API call from within your VPC, the traffic goes through the Internet. If you need this traffic between resources in your VPC and S3 to go through private network then you need to place VPC Gateway Endpoint for S3 into your VPC and route the S3 traffic through it.
Here is a minimal template containing new VPC, one subnet, S3 VPC endpoint and route table for that subnet with route to S3 endpoint for S3 traffic.
AWSTemplateFormatVersion: 2010-09-09
Resources:
MyVPC:
Type: 'AWS::EC2::VPC'
Properties:
CidrBlock: 10.0.0.0/16
EnableDnsHostnames: true
EnableDnsSupport: true
MySubnet:
Type: 'AWS::EC2::Subnet'
Properties:
VpcId: !Ref MyVPC
CidrBlock: 10.0.0.0/24
MyRouteTable:
Type: 'AWS::EC2::RouteTable'
Properties:
VpcId: !Ref MyVPC
SubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref MyRouteTable
SubnetId: !Ref MySubnet
S3Endpoint:
Type: 'AWS::EC2::VPCEndpoint'
Properties:
VpcId: !Ref MyVPC
RouteTableIds:
- !Ref MyRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.s3