Restrict access to public s3 bucket within VPC

s3-restrict-vpc.tf

resource "aws_vpc_endpoint" "s3" {
  vpc_id       = module.vpc.vpc_id
  service_name = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids = [module.public-gateway.route_table_id]
}

resource "aws_s3_bucket" "static" {
  acl    = "public-read"
  bucket = "${var.name_prefix}-static"
}

resource "aws_s3_bucket_policy" "static" {
  bucket = aws_s3_bucket.static.id

  policy = <<POLICY
{
   "Version": "2012-10-17",
   "Id": "static-bucket-allow-VPCE-only",
   "Statement": [
     {
       "Sid": "static-bucket-access-to-specific-VPCE-only",
       "Principal": "*",
       "Action": "s3:*",
       "Effect": "Allow",
       "Resource": ["${aws_s3_bucket.static.arn}",
                    "${aws_s3_bucket.static.arn}/*"],
       "Condition": {
         "StringEquals": {
           "aws:SourceVpce": "${aws_vpc_endpoint.s3.id}"
         }
       }
     }
   ]
}
POLICY
}