CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-ec2amazon-iam
Stan Luo
Stan Luo

Reputation: 3889

AWS EC2 access to S3 with IAM role

Scenario: I have an EC2 instance and a S3 bucket under the same account, and my web app on that EC2 wants access to resources in that bucket.

Following official docs, I created an IAM role with s3access and assigned it to the EC2 instance. To my understanding, now my web app should be able to access the bucket. However, after trials, seems I have to add a allowPublicRead bucket policy like this:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucket/*"
        }
    ]
}

Otherwise I got access forbidden.

But why should I use this allowPublicRead bucket policy, since I already granted s3access IAM role to the EC2 instance?

Upvotes: 4

Views: 1104

Answers (1)

Amit
Amit

Reputation: 32376

S3 s3:GetObject will only allow access to objects from your ec2 instance and what you want is to access these objects from your web-app which means from your browser, in this case these images/objects will be rendered to user browser and if its a public facing application then you need to assign AllowPublicRead permission as well.

Upvotes: 1

Related Questions