diff --git a/examples/tfvars/ecr_endpoint.tfvars b/examples/tfvars/ecr_endpoint.tfvars
index d921a904..e8defaa4 100644
--- a/examples/tfvars/ecr_endpoint.tfvars
+++ b/examples/tfvars/ecr_endpoint.tfvars
@@ -16,4 +16,5 @@ default_node_groups = {
 
 network = {
   create_ecr_endpoint = true
+  create_s3_interface = true
 }
diff --git a/modules/eks/README.md b/modules/eks/README.md
index 75081cb4..5fea356c 100644
--- a/modules/eks/README.md
+++ b/modules/eks/README.md
@@ -53,6 +53,7 @@
 | [aws_security_group_rule.eks_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
 | [aws_security_group_rule.netapp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
 | [aws_security_group_rule.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.s3_endpoint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
 | [null_resource.kubeconfig](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [terraform_data.run_k8s_pre_setup](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [aws_caller_identity.aws_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
@@ -84,7 +85,7 @@
 | <a name="input_ignore_tags"></a> [ignore\_tags](#input\_ignore\_tags) | Tag keys to be ignored by the aws provider. | `list(string)` | `[]` | no |
 | <a name="input_karpenter"></a> [karpenter](#input\_karpenter) | karpenter = {<br/>      enabled = Toggle installation of Karpenter.<br/>      namespace = Namespace to install Karpenter.<br/>      version = Configure the version for Karpenter.<br/>    } | <pre>object({<br/>    enabled   = optional(bool, false)<br/>    namespace = optional(string, "karpenter")<br/>    version   = optional(string, "1.0.6")<br/>  })</pre> | `{}` | no |
 | <a name="input_kms_info"></a> [kms\_info](#input\_kms\_info) | key\_id  = KMS key id.<br/>    key\_arn = KMS key arn.<br/>    enabled = KMS key is enabled | <pre>object({<br/>    key_id  = string<br/>    key_arn = string<br/>    enabled = bool<br/>  })</pre> | n/a | yes |
-| <a name="input_network_info"></a> [network\_info](#input\_network\_info) | id = VPC ID.<br/>    ecr\_endpoint = {<br/>      security\_group\_id = ECR Endpoint security group id.<br/>    }<br/>    subnets = {<br/>      public = List of public Subnets.<br/>      [{<br/>        name = Subnet name.<br/>        subnet\_id = Subnet ud<br/>        az = Subnet availability\_zone<br/>        az\_id = Subnet availability\_zone\_id<br/>      }]<br/>      private = List of private Subnets.<br/>      [{<br/>        name = Subnet name.<br/>        subnet\_id = Subnet ud<br/>        az = Subnet availability\_zone<br/>        az\_id = Subnet availability\_zone\_id<br/>      }]<br/>      pod = List of pod Subnets.<br/>      [{<br/>        name = Subnet name.<br/>        subnet\_id = Subnet ud<br/>        az = Subnet availability\_zone<br/>        az\_id = Subnet availability\_zone\_id<br/>      }]<br/>    } | <pre>object({<br/>    vpc_id = string<br/>    ecr_endpoint = optional(object({<br/>      security_group_id = optional(string, null)<br/>    }), null)<br/>    subnets = object({<br/>      public = list(object({<br/>        name      = string<br/>        subnet_id = string<br/>        az        = string<br/>        az_id     = string<br/>      }))<br/>      private = list(object({<br/>        name      = string<br/>        subnet_id = string<br/>        az        = string<br/>        az_id     = string<br/>      }))<br/>      pod = list(object({<br/>        name      = string<br/>        subnet_id = string<br/>        az        = string<br/>        az_id     = string<br/>      }))<br/>    })<br/>    vpc_cidrs = optional(string, "10.0.0.0/16")<br/>  })</pre> | n/a | yes |
+| <a name="input_network_info"></a> [network\_info](#input\_network\_info) | id = VPC ID.<br/>    ecr\_endpoint = {<br/>      security\_group\_id = ECR Endpoint security group id.<br/>    }<br/>    s3\_endpoint = {<br/>      security\_group\_id = S3 Endpoint security group id.<br/>    }<br/>    subnets = {<br/>      public = List of public Subnets.<br/>      [{<br/>        name = Subnet name.<br/>        subnet\_id = Subnet ud<br/>        az = Subnet availability\_zone<br/>        az\_id = Subnet availability\_zone\_id<br/>      }]<br/>      private = List of private Subnets.<br/>      [{<br/>        name = Subnet name.<br/>        subnet\_id = Subnet ud<br/>        az = Subnet availability\_zone<br/>        az\_id = Subnet availability\_zone\_id<br/>      }]<br/>      pod = List of pod Subnets.<br/>      [{<br/>        name = Subnet name.<br/>        subnet\_id = Subnet ud<br/>        az = Subnet availability\_zone<br/>        az\_id = Subnet availability\_zone\_id<br/>      }]<br/>    } | <pre>object({<br/>    vpc_id = string<br/>    ecr_endpoint = optional(object({<br/>      security_group_id = optional(string, null)<br/>    }), null)<br/>    s3_endpoint = optional(object({<br/>      security_group_id = optional(string, null)<br/>    }), null)<br/>    subnets = object({<br/>      public = list(object({<br/>        name      = string<br/>        subnet_id = string<br/>        az        = string<br/>        az_id     = string<br/>      }))<br/>      private = list(object({<br/>        name      = string<br/>        subnet_id = string<br/>        az        = string<br/>        az_id     = string<br/>      }))<br/>      pod = list(object({<br/>        name      = string<br/>        subnet_id = string<br/>        az        = string<br/>        az_id     = string<br/>      }))<br/>    })<br/>    vpc_cidrs = optional(string, "10.0.0.0/16")<br/>  })</pre> | n/a | yes |
 | <a name="input_node_iam_policies"></a> [node\_iam\_policies](#input\_node\_iam\_policies) | Additional IAM Policy Arns for Nodes | `list(string)` | n/a | yes |
 | <a name="input_privatelink"></a> [privatelink](#input\_privatelink) | {<br/>      enabled = Enable Private Link connections.<br/>      namespace = Namespace for IAM Policy conditions.<br/>      monitoring\_bucket = Bucket for NLBs monitoring.<br/>      route53\_hosted\_zone\_name = Hosted zone for External DNS zone.<br/>      vpc\_endpoint\_services = [{<br/>        name      = Name of the VPC Endpoint Service.<br/>        ports     = List of ports exposing the VPC Endpoint Service. i.e [8080, 8081]<br/>        cert\_arn  = Certificate ARN used by the NLB associated for the given VPC Endpoint Service.<br/>        private\_dns = Private DNS for the VPC Endpoint Service.<br/>      }]<br/>    } | <pre>object({<br/>    enabled                  = optional(bool, false)<br/>    namespace                = optional(string, "domino-platform")<br/>    monitoring_bucket        = optional(string, null)<br/>    route53_hosted_zone_name = optional(string, null)<br/>    vpc_endpoint_services = optional(list(object({<br/>      name        = optional(string)<br/>      ports       = optional(list(number))<br/>      cert_arn    = optional(string)<br/>      private_dns = optional(string)<br/>    })), [])<br/>  })</pre> | `{}` | no |
 | <a name="input_region"></a> [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
diff --git a/modules/eks/node-group.tf b/modules/eks/node-group.tf
index 4e5d4b04..4b3589c4 100644
--- a/modules/eks/node-group.tf
+++ b/modules/eks/node-group.tf
@@ -95,3 +95,14 @@ resource "aws_security_group_rule" "ecr_endpoint" {
   description              = "ECR Endpoint access from EKS nodes."
   source_security_group_id = aws_security_group.eks_nodes.id
 }
+
+resource "aws_security_group_rule" "s3_endpoint" {
+  count                    = var.network_info.s3_endpoint != null ? 1 : 0
+  security_group_id        = var.network_info.s3_endpoint.security_group_id
+  protocol                 = "tcp"
+  from_port                = 443
+  to_port                  = 443
+  type                     = "ingress"
+  description              = "S3 Endpoint access from EKS nodes."
+  source_security_group_id = aws_security_group.eks_nodes.id
+}
diff --git a/modules/eks/variables.tf b/modules/eks/variables.tf
index 7a47ee4f..e0dc13c7 100644
--- a/modules/eks/variables.tf
+++ b/modules/eks/variables.tf
@@ -24,6 +24,9 @@ variable "network_info" {
     ecr_endpoint = {
       security_group_id = ECR Endpoint security group id.
     }
+    s3_endpoint = {
+      security_group_id = S3 Endpoint security group id.
+    }
     subnets = {
       public = List of public Subnets.
       [{
@@ -53,6 +56,9 @@ variable "network_info" {
     ecr_endpoint = optional(object({
       security_group_id = optional(string, null)
     }), null)
+    s3_endpoint = optional(object({
+      security_group_id = optional(string, null)
+    }), null)
     subnets = object({
       public = list(object({
         name      = string
diff --git a/modules/infra/README.md b/modules/infra/README.md
index 0bb11617..2f09d5fe 100644
--- a/modules/infra/README.md
+++ b/modules/infra/README.md
@@ -62,7 +62,7 @@
 | <a name="input_ignore_tags"></a> [ignore\_tags](#input\_ignore\_tags) | Tag keys to be ignored by the aws provider. | `list(string)` | `[]` | no |
 | <a name="input_karpenter_node_groups"></a> [karpenter\_node\_groups](#input\_karpenter\_node\_groups) | Configuration for EKS node groups managed by Karpenter. These node groups are designed to dynamically scale<br/>    workloads based on resource requirements.<br/>    Set `single_nodegroup: true` to create a single node group spanning multiple availability zones (AZs)<br/>    instead of creating a separate node group per AZ. This is useful for simplifying management but may<br/>    not be ideal for workloads requiring strict zone affinity (e.g., due to EBS volume zonal constraints). | <pre>map(object({<br/>    ami                        = optional(string, null)<br/>    bootstrap_extra_args       = optional(string, "")<br/>    instance_types             = optional(list(string), ["m6a.large"])<br/>    spot                       = optional(bool, false)<br/>    min_per_az                 = optional(number, 1)<br/>    max_per_az                 = optional(number, 1)<br/>    max_unavailable_percentage = optional(number, 50)<br/>    max_unavailable            = optional(number)<br/>    desired_per_az             = optional(number, 1)<br/>    availability_zone_ids      = list(string)<br/>    labels = optional(map(string), {<br/>      "dominodatalab.com/node-pool" = "karpenter"<br/>    })<br/>    taints = optional(list(object({<br/>      key    = string<br/>      value  = optional(string)<br/>      effect = string<br/>    })), [])<br/>    tags = optional(map(string), {})<br/>    gpu  = optional(bool, null)<br/>    volume = optional(object({<br/>      size       = optional(string, "30")<br/>      type       = optional(string, "gp3")<br/>      iops       = optional(number)<br/>      throughput = optional(number, 500)<br/>    }), {})<br/>    single_nodegroup = optional(bool, false)<br/>  }))</pre> | `{}` | no |
 | <a name="input_kms"></a> [kms](#input\_kms) | enabled             = "Toggle, if set use either the specified KMS key\_id or a Domino-generated one"<br/>    key\_id              = optional(string, null)<br/>    additional\_policies = "Allows setting additional KMS key policies when using a Domino-generated key" | <pre>object({<br/>    enabled             = optional(bool, true)<br/>    key_id              = optional(string, null)<br/>    additional_policies = optional(list(string), [])<br/>  })</pre> | `{}` | no |
-| <a name="input_network"></a> [network](#input\_network) | vpc = {<br/>      id = Existing vpc id, it will bypass creation by this module.<br/>      subnets = {<br/>        private = Existing private subnets.<br/>        public  = Existing public subnets.<br/>        pod     = Existing pod subnets.<br/>      }), {})<br/>    }), {})<br/>    network\_bits = {<br/>      public  = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.<br/>      private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>      pod     = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>    }<br/>    cidrs = {<br/>      vpc     = The IPv4 CIDR block for the VPC.<br/>      pod     = The IPv4 CIDR block for the Pod subnets.<br/>    }<br/>    use\_pod\_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.<br/>    create\_ecr\_endpoint = Create the VPC Endpoint For ECR. | <pre>object({<br/>    vpc = optional(object({<br/>      id = optional(string, null)<br/>      subnets = optional(object({<br/>        private = optional(list(string), [])<br/>        public  = optional(list(string), [])<br/>        pod     = optional(list(string), [])<br/>      }), {})<br/>    }), {})<br/>    network_bits = optional(object({<br/>      public  = optional(number, 27)<br/>      private = optional(number, 19)<br/>      pod     = optional(number, 19)<br/>      }<br/>    ), {})<br/>    cidrs = optional(object({<br/>      vpc = optional(string, "10.0.0.0/16")<br/>      pod = optional(string, "100.64.0.0/16")<br/>    }), {})<br/>    use_pod_cidr        = optional(bool, true)<br/>    create_ecr_endpoint = optional(bool, false)<br/>  })</pre> | `{}` | no |
+| <a name="input_network"></a> [network](#input\_network) | vpc = {<br/>      id = Existing vpc id, it will bypass creation by this module.<br/>      subnets = {<br/>        private = Existing private subnets.<br/>        public  = Existing public subnets.<br/>        pod     = Existing pod subnets.<br/>      }), {})<br/>    }), {})<br/>    network\_bits = {<br/>      public  = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.<br/>      private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>      pod     = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>    }<br/>    cidrs = {<br/>      vpc     = The IPv4 CIDR block for the VPC.<br/>      pod     = The IPv4 CIDR block for the Pod subnets.<br/>    }<br/>    use\_pod\_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.<br/>    create\_ecr\_endpoint = Create the VPC Endpoint For ECR.<br/>    create\_s3\_interface = Create the VPC Interface Endpoint For S3. | <pre>object({<br/>    vpc = optional(object({<br/>      id = optional(string, null)<br/>      subnets = optional(object({<br/>        private = optional(list(string), [])<br/>        public  = optional(list(string), [])<br/>        pod     = optional(list(string), [])<br/>      }), {})<br/>    }), {})<br/>    network_bits = optional(object({<br/>      public  = optional(number, 27)<br/>      private = optional(number, 19)<br/>      pod     = optional(number, 19)<br/>      }<br/>    ), {})<br/>    cidrs = optional(object({<br/>      vpc = optional(string, "10.0.0.0/16")<br/>      pod = optional(string, "100.64.0.0/16")<br/>    }), {})<br/>    use_pod_cidr        = optional(bool, true)<br/>    create_ecr_endpoint = optional(bool, false)<br/>    create_s3_interface = optional(bool, false)<br/>  })</pre> | `{}` | no |
 | <a name="input_region"></a> [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
 | <a name="input_ssh_pvt_key_path"></a> [ssh\_pvt\_key\_path](#input\_ssh\_pvt\_key\_path) | SSH private key filepath. | `string` | n/a | yes |
 | <a name="input_storage"></a> [storage](#input\_storage) | storage = {<br/>      filesystem\_type = File system type(netapp\|efs)<br/>      efs = {<br/>        access\_point\_path = Filesystem path for efs.<br/>        backup\_vault = {<br/>          create        = Create backup vault for EFS toggle.<br/>          force\_destroy = Toggle to allow automatic destruction of all backups when destroying.<br/>          backup = {<br/>            schedule           = Cron-style schedule for EFS backup vault (default: once a day at 12pm).<br/>            cold\_storage\_after = Move backup data to cold storage after this many days.<br/>            delete\_after       = Delete backup data after this many days.<br/>          }<br/>        }<br/>      }<br/>      netapp = {<br/>        migrate\_from\_efs = {<br/>          enabled =  When enabled, both EFS and NetApp resources will be provisioned simultaneously during the migration period.<br/>          datasync = {<br/>            enabled  = Toggle to enable AWS DataSync for automated data transfer from EFS to NetApp FSx.<br/>            schedule = Cron-style schedule for the DataSync task, specifying how often the data transfer will occur (default: hourly).<br/>            verify\_mode = One of: POINT\_IN\_TIME\_CONSISTENT, ONLY\_FILES\_TRANSFERRED, NONE.<br/>          }<br/>        }<br/>        deployment\_type = netapp ontap deployment type,('MULTI\_AZ\_1', 'MULTI\_AZ\_2', 'SINGLE\_AZ\_1', 'SINGLE\_AZ\_2')<br/>        storage\_capacity = Filesystem Storage capacity<br/>        throughput\_capacity = Filesystem throughput capacity<br/>        automatic\_backup\_retention\_days = How many days to keep backups<br/>        daily\_automatic\_backup\_start\_time = Start time in 'HH:MM' format to initiate backups<br/><br/>        storage\_capacity\_autosizing = Options for the FXN automatic storage capacity increase, cloudformation template<br/>          enabled                     = Enable automatic storage capacity increase.<br/>          threshold                  = Used storage capacity threshold.<br/>          percent\_capacity\_increase  = The percentage increase in storage capacity when used storage exceeds<br/>                                       LowFreeDataStorageCapacityThreshold. Minimum increase is 10 %.<br/>          notification\_email\_address = The email address for alarm notification.<br/>        }<br/>        volume = {<br/>          create                     = Create a volume associated with the filesystem.<br/>          name\_suffix                = The suffix to name the volume<br/>          storage\_efficiency\_enabled = Toggle storage\_efficiency\_enabled<br/>          junction\_path              = filesystem junction path<br/>          size\_in\_megabytes          = The size of the volume<br/>      }<br/>      s3 = {<br/>        force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the s3 buckets. if 'false' terraform will NOT be able to delete non-empty buckets.<br/>      }<br/>      ecr = {<br/>        force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the ECR repositories. if 'false' terraform will NOT be able to delete non-empty repositories.<br/>      }<br/>      enable\_remote\_backup = Enable tagging required for cross-account backups<br/>      costs\_enabled = Determines whether to provision domino cost related infrastructures, ie, long term storage<br/>    }<br/>  } | <pre>object({<br/>    filesystem_type = optional(string, "efs")<br/>    efs = optional(object({<br/>      access_point_path = optional(string, "/domino")<br/>      backup_vault = optional(object({<br/>        create        = optional(bool, true)<br/>        force_destroy = optional(bool, true)<br/>        backup = optional(object({<br/>          schedule           = optional(string, "0 12 * * ? *")<br/>          cold_storage_after = optional(number, 35)<br/>          delete_after       = optional(number, 125)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>    netapp = optional(object({<br/>      migrate_from_efs = optional(object({<br/>        enabled = optional(bool, false)<br/>        datasync = optional(object({<br/>          enabled     = optional(bool, false)<br/>          target      = optional(string, "netapp")<br/>          schedule    = optional(string, "cron(0 */4 * * ? *)")<br/>          verify_mode = optional(string, "ONLY_FILES_TRANSFERRED")<br/>        }), {})<br/>      }), {})<br/>      deployment_type                   = optional(string, "SINGLE_AZ_1")<br/>      storage_capacity                  = optional(number, 1024)<br/>      throughput_capacity               = optional(number, 128)<br/>      automatic_backup_retention_days   = optional(number, 90)<br/>      daily_automatic_backup_start_time = optional(string, "00:00")<br/>      storage_capacity_autosizing = optional(object({<br/>        enabled                    = optional(bool, false)<br/>        threshold                  = optional(number, 70)<br/>        percent_capacity_increase  = optional(number, 30)<br/>        notification_email_address = optional(string, "")<br/>      }), {})<br/>      volume = optional(object({<br/>        create                     = optional(bool, true)<br/>        name_suffix                = optional(string, "domino_shared_storage")<br/>        storage_efficiency_enabled = optional(bool, true)<br/>        junction_path              = optional(string, "/domino")<br/>        size_in_megabytes          = optional(number, 1048576)<br/>      }), {})<br/>    }), {})<br/>    s3 = optional(object({<br/>      force_destroy_on_deletion = optional(bool, true)<br/>    }), {})<br/>    ecr = optional(object({<br/>      force_destroy_on_deletion = optional(bool, true)<br/>    }), {}),<br/>    enable_remote_backup = optional(bool, false)<br/>    costs_enabled        = optional(bool, true)<br/>  })</pre> | `{}` | no |
diff --git a/modules/infra/submodules/network/README.md b/modules/infra/submodules/network/README.md
index eab302d1..ed42dc4d 100644
--- a/modules/infra/submodules/network/README.md
+++ b/modules/infra/submodules/network/README.md
@@ -6,13 +6,13 @@
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.7 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.7 |
 
 ## Modules
 
@@ -35,6 +35,7 @@ No modules.
 | [aws_route_table_association.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |
 | [aws_route_table_association.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |
 | [aws_security_group.ecr_endpoint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
+| [aws_security_group.s3_endpoint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
 | [aws_subnet.pod](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
 | [aws_subnet.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
 | [aws_subnet.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
@@ -42,6 +43,7 @@ No modules.
 | [aws_vpc_endpoint.ecr_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.ecr_dkr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_vpc_endpoint.s3_interface](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_ipv4_cidr_block_association.pod_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipv4_cidr_block_association) | resource |
 | [aws_availability_zone.zones](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zone) | data source |
 | [aws_network_acls.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/network_acls) | data source |
@@ -58,7 +60,7 @@ No modules.
 | <a name="input_add_eks_elb_tags"></a> [add\_eks\_elb\_tags](#input\_add\_eks\_elb\_tags) | Toggle k8s cluster tag on subnet | `bool` | `true` | no |
 | <a name="input_deploy_id"></a> [deploy\_id](#input\_deploy\_id) | Domino Deployment ID | `string` | n/a | yes |
 | <a name="input_flow_log_bucket_arn"></a> [flow\_log\_bucket\_arn](#input\_flow\_log\_bucket\_arn) | Bucket for vpc flow logging | `object({ arn = string })` | `null` | no |
-| <a name="input_network"></a> [network](#input\_network) | vpc = {<br/>      id = Existing vpc id, it will bypass creation by this module.<br/>      subnets = {<br/>        private = Existing private subnets.<br/>        public  = Existing public subnets.<br/>        pod     = Existing pod subnets.<br/>      }), {})<br/>    }), {})<br/>    network\_bits = {<br/>      public  = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.<br/>      private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>      pod     = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>    }<br/>    cidrs = {<br/>      vpc     = The IPv4 CIDR block for the VPC.<br/>      pod     = The IPv4 CIDR block for the Pod subnets.<br/>    }<br/>    use\_pod\_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.<br/>    create\_ecr\_endpoint = Create the VPC Endpoint For ECR. | <pre>object({<br/>    vpc = optional(object({<br/>      id = optional(string)<br/>      subnets = optional(object({<br/>        private = optional(list(string))<br/>        public  = optional(list(string))<br/>        pod     = optional(list(string))<br/>      }))<br/>    }))<br/>    network_bits = optional(object({<br/>      public  = optional(number)<br/>      private = optional(number)<br/>      pod     = optional(number)<br/>      }<br/>    ))<br/>    cidrs = optional(object({<br/>      vpc = optional(string)<br/>      pod = optional(string)<br/>    }))<br/>    use_pod_cidr        = optional(bool)<br/>    create_ecr_endpoint = optional(bool, false)<br/>  })</pre> | n/a | yes |
+| <a name="input_network"></a> [network](#input\_network) | vpc = {<br/>      id = Existing vpc id, it will bypass creation by this module.<br/>      subnets = {<br/>        private = Existing private subnets.<br/>        public  = Existing public subnets.<br/>        pod     = Existing pod subnets.<br/>      }), {})<br/>    }), {})<br/>    network\_bits = {<br/>      public  = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.<br/>      private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>      pod     = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>    }<br/>    cidrs = {<br/>      vpc     = The IPv4 CIDR block for the VPC.<br/>      pod     = The IPv4 CIDR block for the Pod subnets.<br/>    }<br/>    use\_pod\_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.<br/>    create\_ecr\_endpoint = Create the VPC Endpoint For ECR.<br/>    create\_s3\_interface = Create the VPC Interface Endpoint For S3. | <pre>object({<br/>    vpc = optional(object({<br/>      id = optional(string)<br/>      subnets = optional(object({<br/>        private = optional(list(string))<br/>        public  = optional(list(string))<br/>        pod     = optional(list(string))<br/>      }))<br/>    }))<br/>    network_bits = optional(object({<br/>      public  = optional(number)<br/>      private = optional(number)<br/>      pod     = optional(number)<br/>      }<br/>    ))<br/>    cidrs = optional(object({<br/>      vpc = optional(string)<br/>      pod = optional(string)<br/>    }))<br/>    use_pod_cidr        = optional(bool)<br/>    create_ecr_endpoint = optional(bool, false)<br/>    create_s3_interface = optional(bool, false)<br/>  })</pre> | n/a | yes |
 | <a name="input_node_groups"></a> [node\_groups](#input\_node\_groups) | EKS managed node groups definition. | <pre>map(object({<br/>    ami                   = string<br/>    bootstrap_extra_args  = string<br/>    instance_types        = list(string)<br/>    spot                  = bool<br/>    min_per_az            = number<br/>    max_per_az            = number<br/>    desired_per_az        = number<br/>    availability_zone_ids = list(string)<br/>    labels                = map(string)<br/>    taints = list(object({<br/>      key    = string<br/>      value  = string<br/>      effect = string<br/>    }))<br/>    tags          = map(string)<br/>    instance_tags = map(string)<br/>    gpu           = bool<br/>    volume = object({<br/>      size       = string<br/>      type       = string<br/>      iops       = optional(number)<br/>      throughput = optional(number, 500)<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_region"></a> [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
 
diff --git a/modules/infra/submodules/network/main.tf b/modules/infra/submodules/network/main.tf
index 3dc5f6df..cabe3b0c 100644
--- a/modules/infra/submodules/network/main.tf
+++ b/modules/infra/submodules/network/main.tf
@@ -2,6 +2,7 @@ locals {
   create_vpc          = var.network.vpc.id == null
   provided_vpc        = var.network.vpc.id != null
   create_ecr_endpoint = local.create_vpc && var.network.create_ecr_endpoint
+  create_s3_interface = local.create_vpc && var.network.create_s3_interface
 }
 
 data "aws_subnet" "public" {
diff --git a/modules/infra/submodules/network/outputs.tf b/modules/infra/submodules/network/outputs.tf
index 8d5a2435..52b03217 100644
--- a/modules/infra/submodules/network/outputs.tf
+++ b/modules/infra/submodules/network/outputs.tf
@@ -20,5 +20,8 @@ output "info" {
     ecr_endpoint = local.create_ecr_endpoint ? {
       security_group_id = aws_security_group.ecr_endpoint[0].id
     } : null
+    s3_endpoint = local.create_s3_interface ? {
+      security_group_id = aws_security_group.s3_endpoint[0].id
+    } : null
   }
 }
diff --git a/modules/infra/submodules/network/variables.tf b/modules/infra/submodules/network/variables.tf
index 065453c8..5a5f374e 100644
--- a/modules/infra/submodules/network/variables.tf
+++ b/modules/infra/submodules/network/variables.tf
@@ -52,6 +52,7 @@ variable "network" {
     }
     use_pod_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.
     create_ecr_endpoint = Create the VPC Endpoint For ECR.
+    create_s3_interface = Create the VPC Interface Endpoint For S3.
   EOF
 
   type = object({
@@ -75,6 +76,7 @@ variable "network" {
     }))
     use_pod_cidr        = optional(bool)
     create_ecr_endpoint = optional(bool, false)
+    create_s3_interface = optional(bool, false)
   })
 
   validation {
diff --git a/modules/infra/submodules/network/versions.tf b/modules/infra/submodules/network/versions.tf
index 50fd4e1c..251ff57b 100644
--- a/modules/infra/submodules/network/versions.tf
+++ b/modules/infra/submodules/network/versions.tf
@@ -3,7 +3,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 5.7"
     }
   }
 }
diff --git a/modules/infra/submodules/network/vpc.tf b/modules/infra/submodules/network/vpc.tf
index e548d194..4e6e4fdd 100644
--- a/modules/infra/submodules/network/vpc.tf
+++ b/modules/infra/submodules/network/vpc.tf
@@ -49,6 +49,39 @@ resource "aws_vpc_endpoint" "s3" {
   }
 }
 
+resource "aws_security_group" "s3_endpoint" {
+  count       = local.create_s3_interface ? 1 : 0
+  name        = "${var.deploy_id}-s3-endpoint"
+  description = "S3 Endpoint security group"
+  vpc_id      = aws_vpc.this[0].id
+
+  lifecycle {
+    create_before_destroy = true
+  }
+  tags = {
+    "Name" = "${var.deploy_id}-s3-endpoint"
+  }
+}
+
+resource "aws_vpc_endpoint" "s3_interface" {
+  count               = local.create_s3_interface ? 1 : 0
+  vpc_id              = aws_vpc.this[0].id
+  service_name        = "com.amazonaws.${var.region}.s3"
+  vpc_endpoint_type   = "Interface"
+  private_dns_enabled = true
+  subnet_ids          = [for s in aws_subnet.pod : s.id]
+
+  security_group_ids = [
+    aws_security_group.s3_endpoint[0].id,
+  ]
+
+  tags = {
+    "Name" = "${var.deploy_id}-s3"
+  }
+
+  depends_on = [aws_vpc_endpoint.s3]
+}
+
 data "aws_prefix_list" "s3" {
   count          = local.create_vpc ? 1 : 0
   prefix_list_id = aws_vpc_endpoint.s3[0].prefix_list_id
diff --git a/modules/infra/variables.tf b/modules/infra/variables.tf
index ed633ecf..1090b681 100644
--- a/modules/infra/variables.tf
+++ b/modules/infra/variables.tf
@@ -318,6 +318,7 @@ variable "network" {
     }
     use_pod_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.
     create_ecr_endpoint = Create the VPC Endpoint For ECR.
+    create_s3_interface = Create the VPC Interface Endpoint For S3.
   EOF
 
   type = object({
@@ -341,6 +342,7 @@ variable "network" {
     }), {})
     use_pod_cidr        = optional(bool, true)
     create_ecr_endpoint = optional(bool, false)
+    create_s3_interface = optional(bool, false)
   })
 
   default = {}
diff --git a/tests/plan/terraform/README.md b/tests/plan/terraform/README.md
index e2b2f400..a62a05aa 100644
--- a/tests/plan/terraform/README.md
+++ b/tests/plan/terraform/README.md
@@ -48,7 +48,7 @@
 | <a name="input_external_deployments_operator"></a> [external\_deployments\_operator](#input\_external\_deployments\_operator) | Config to create IRSA role for the external deployments operator. | <pre>object({<br/>    enabled                         = optional(bool, false)<br/>    namespace                       = optional(string, "domino-compute")<br/>    operator_service_account_name   = optional(string, "pham-juno-operator")<br/>    operator_role_suffix            = optional(string, "external-deployments-operator")<br/>    repository_suffix               = optional(string, "external-deployments")<br/>    bucket_suffix                   = optional(string, "external-deployments")<br/>    enable_assume_any_external_role = optional(bool, true)<br/>    enable_in_account_deployments   = optional(bool, true)<br/>  })</pre> | `{}` | no |
 | <a name="input_ignore_tags"></a> [ignore\_tags](#input\_ignore\_tags) | Tag keys to be ignored by the aws provider. | `list(string)` | `[]` | no |
 | <a name="input_kms"></a> [kms](#input\_kms) | enabled = Toggle,if set use either the specified KMS key\_id or a Domino-generated one.<br/>    key\_id  = optional(string, null)<br/>    additional\_policies = "Allows setting additional KMS key policies when using a Domino-generated key" | <pre>object({<br/>    enabled             = optional(bool, true)<br/>    key_id              = optional(string, null)<br/>    additional_policies = optional(list(string), [])<br/>  })</pre> | `{}` | no |
-| <a name="input_network"></a> [network](#input\_network) | vpc = {<br/>      id = Existing vpc id, it will bypass creation by this module.<br/>      subnets = {<br/>        private = Existing private subnets.<br/>        public  = Existing public subnets.<br/>        pod     = Existing pod subnets.<br/>      }), {})<br/>    }), {})<br/>    network\_bits = {<br/>      public  = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.<br/>      private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>      pod     = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>    }<br/>    cidrs = {<br/>      vpc     = The IPv4 CIDR block for the VPC.<br/>      pod     = The IPv4 CIDR block for the Pod subnets.<br/>    }<br/>    use\_pod\_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.<br/>    create\_ecr\_endpoint = Create the VPC Endpoint For ECR. | <pre>object({<br/>    vpc = optional(object({<br/>      id = optional(string, null)<br/>      subnets = optional(object({<br/>        private = optional(list(string), [])<br/>        public  = optional(list(string), [])<br/>        pod     = optional(list(string), [])<br/>      }), {})<br/>    }), {})<br/>    network_bits = optional(object({<br/>      public  = optional(number, 27)<br/>      private = optional(number, 19)<br/>      pod     = optional(number, 19)<br/>      }<br/>    ), {})<br/>    cidrs = optional(object({<br/>      vpc = optional(string, "10.0.0.0/16")<br/>      pod = optional(string, "100.64.0.0/16")<br/>    }), {})<br/>    use_pod_cidr        = optional(bool, true)<br/>    create_ecr_endpoint = optional(bool, false)<br/>  })</pre> | `{}` | no |
+| <a name="input_network"></a> [network](#input\_network) | vpc = {<br/>      id = Existing vpc id, it will bypass creation by this module.<br/>      subnets = {<br/>        private = Existing private subnets.<br/>        public  = Existing public subnets.<br/>        pod     = Existing pod subnets.<br/>      }), {})<br/>    }), {})<br/>    network\_bits = {<br/>      public  = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.<br/>      private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>      pod     = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.<br/>    }<br/>    cidrs = {<br/>      vpc     = The IPv4 CIDR block for the VPC.<br/>      pod     = The IPv4 CIDR block for the Pod subnets.<br/>    }<br/>    use\_pod\_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.<br/>    create\_ecr\_endpoint = Create the VPC Endpoint For ECR.<br/>    create\_s3\_interface = Create the VPC Interface Endpoint For S3. | <pre>object({<br/>    vpc = optional(object({<br/>      id = optional(string, null)<br/>      subnets = optional(object({<br/>        private = optional(list(string), [])<br/>        public  = optional(list(string), [])<br/>        pod     = optional(list(string), [])<br/>      }), {})<br/>    }), {})<br/>    network_bits = optional(object({<br/>      public  = optional(number, 27)<br/>      private = optional(number, 19)<br/>      pod     = optional(number, 19)<br/>      }<br/>    ), {})<br/>    cidrs = optional(object({<br/>      vpc = optional(string, "10.0.0.0/16")<br/>      pod = optional(string, "100.64.0.0/16")<br/>    }), {})<br/>    use_pod_cidr        = optional(bool, true)<br/>    create_ecr_endpoint = optional(bool, false)<br/>    create_s3_interface = optional(bool, false)<br/>  })</pre> | `{}` | no |
 | <a name="input_region"></a> [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
 | <a name="input_route53_hosted_zone_name"></a> [route53\_hosted\_zone\_name](#input\_route53\_hosted\_zone\_name) | Optional hosted zone for External DNS zone. | `string` | `null` | no |
 | <a name="input_single_node"></a> [single\_node](#input\_single\_node) | Additional EKS managed node groups definition. | <pre>object({<br/>    name                 = optional(string, "single-node")<br/>    bootstrap_extra_args = optional(string, "")<br/>    ami = optional(object({<br/>      name_prefix = optional(string, null)<br/>      owner       = optional(string, null)<br/><br/>    }))<br/>    instance_type            = optional(string, "m6i.2xlarge")<br/>    authorized_ssh_ip_ranges = optional(list(string), ["0.0.0.0/0"])<br/>    labels                   = optional(map(string))<br/>    taints = optional(list(object({<br/>      key    = string<br/>      value  = optional(string)<br/>      effect = string<br/>    })), [])<br/>    volume = optional(object({<br/>      size = optional(number, 1000)<br/>      type = optional(string, "gp3")<br/>    }), {})<br/>  })</pre> | `null` | no |
diff --git a/tests/plan/terraform/variables.tf b/tests/plan/terraform/variables.tf
index f534711b..0dfaaa79 100644
--- a/tests/plan/terraform/variables.tf
+++ b/tests/plan/terraform/variables.tf
@@ -279,6 +279,7 @@ variable "network" {
     }
     use_pod_cidr        = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking.
     create_ecr_endpoint = Create the VPC Endpoint For ECR.
+    create_s3_interface = Create the VPC Interface Endpoint For S3.
   EOF
 
   type = object({
@@ -302,6 +303,7 @@ variable "network" {
     }), {})
     use_pod_cidr        = optional(bool, true)
     create_ecr_endpoint = optional(bool, false)
+    create_s3_interface = optional(bool, false)
   })
 
   default = {}