<p>I've created an "Istio-enabled" Kubernetes cluster, and my containers, by default, "<a href="https://archive.istio.io/v1.0/docs/tasks/traffic-management/egress/" rel="nofollow noreferrer">are unable to access URLs outside of the cluster</a>" (Istio v1.0.2). This is fine and matches my security requirements:</p>

<blockquote>
  <p>By default, Istio-enabled services are unable to access URLs outside
  of the cluster because the pod uses iptables to transparently redirect
  all outbound traffic to the sidecar proxy...</p>
</blockquote>

<p>Now I'm trying to create an <a href="https://archive.istio.io/v1.0/docs/concepts/traffic-management/#service-entries" rel="nofollow noreferrer">Istio Service Entry</a> to <strong>allow my containers to requests my s3 buckets</strong> that are outside the Istio service mesh.  </p>

<p>As far I know, Amazon S3 does not have a specific "host" or a well-defined range of IP addresses. How can I do this? What protocol do I need to use?</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: enable-access-to-s3-buckets
spec:
  hosts:
  - ????????
  ports:
  - number: ???????
    name: ??????
    protocol: ??????
  resolution: ?????
</code></pre>

<hr>

<p><em>Note: <a href="https://istio.io/news/2019/announcing-1.2/#traffic-management" rel="nofollow noreferrer">Istio v1.2</a> changed the default outbound traffic policy to <code>ALLOW_ANY</code>.</em></p>

<p>Looking here you can get a list on the terminating points of s3 that might help: <a href="https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region</a></p>

<p>Another solution can be to create a s3 endpoint inside the same VPC of your K8S cluster and use that name to restrict the access with private IPs rules. see <a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html</a> for a detailed documentation on it.</p>
