Anonymous access to S3 bucket only from the EC2 instances

amazon ec2amazon s3

Is there a way to let anonymous access to a certain S3 bucket only from my EC2 instances (all of them) within a single AWS account?

  1. I know I can use IAM roles, but I found it's just too many moving parts, and complicates any scripts that have to use the access key/secret key (e.g. rewriting /etc/apt/* lines when it changes). Not to mention there is no way to attach roles to existing instances, which makes it even more pain.

  2. It's also not possible to simply restrict access by using VPC subnet, because S3 bucket access goes via public EC2 interface.

Best Answer

Yeah you have attach a bucket policy to the bucket like this:

{
   "Version":"2012-10-17",
   "Statement":[{
         "Sid":"AddCannedAcl",
         "Effect":"Allow",
         "Principal": {
            "AWS": ["arn:aws:iam::111122223333:root"]
         },
         "Action":[
            "s3:GetObject",
            "s3:GetObjectAcl"
         ],
         "Resource":["arn:aws:s3:::bucket/*"]
      ]
   }]
}

where 111122223333 is your account id

Related Topic