20

I need to fire up an S3 bucket so my EC2 instances have access to store image files to it. The EC2 instances need read/write permissions. I do not want to make the S3 bucket publicly available, I only want the EC2 instances to have access to it.

The other gotcha is my EC2 instances are being managed by OpsWorks and I can have may different instances being fired up depending on load/usage. If I were to restrict it by IP, I may not always know the IP the EC2 instances have. Can I restrict by VPC?

Do I have to make my S3 bucket enabled for static website hosting? Do I need to make all files in the bucket public as well for this to work?

hiddenicon
  • 551
  • 2
  • 11
  • 23

3 Answers3

21

You do not need to make the bucket public readable, nor the files public readable. The bucket and it's contents can be kept private.

Don't restrict access to the bucket based on IP address, instead restrict it based on the IAM role the EC2 instance is using.

  1. Create an IAM EC2 Instance role for your EC2 instances.
  2. Run your EC2 instances using that role.
  3. Give this IAM role a policy to access the S3 bucket.

For example:

{
  "Version": "2012-10-17",
  "Statement":[{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::my_bucket",
                 "arn:aws:s3:::my_bucket/*"]
    }
  ]
}
  1. If you want to restrict access to the bucket itself, try an S3 bucket policy.

For example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::111122223333:role/my-ec2-role"]
      },
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my_bucket",
                   "arn:aws:s3:::my_bucket/*"]
    }
  ]
}

Additional information: http://blogs.aws.amazon.com/security/post/TxPOJBY6FE360K/IAM-policies-and-Bucket-Policies-and-ACLs-Oh-My-Controlling-Access-to-S3-Resourc

Community
  • 1
  • 1
Matt Houser
  • 33,983
  • 6
  • 70
  • 88
  • I attempted to restrict by VPC and I got myself completely locked out of the S3 bucket. I had to create access keys on my root account and use the AWS CLI tools to delete the bucket policy. Can I add a second access method as well? So I can still access the bucket from a public IP? – hiddenicon Dec 04 '15 at 01:56
  • One issue I have is that I'm doing a reverse proxy on Apache to access images on the S3 bucket as below. So it'd have to be publicly available via https. ProxyRequests Off Order deny,allow Allow from all ProxyPass /images/ http://images.s3-website-us-east-1.amazonaws.com/ – hiddenicon Dec 04 '15 at 02:47
  • how do you call that s3 bucket from the ec2 instance? Any examples? – user1655072 Sep 26 '19 at 19:33
3

This can be done very simply. Follow the following steps:

  • Open the AWS EC2 on console.
  • Select the instance and navigate to actions.
  • Select instances settings and select Attach/Replace IAM Role
  • Create a new role and attach S3FullAccess policy to that role.

When this is done, connect to the AWS instance and the rest will be done via the following CLI commands:

  • aws s3 cp filelocation/filename s3://bucketname

Please note... the file location refers to the local address. And the bucketname is the name of your bucket. Also note: This is possible if your instance and S3 bucket are in the same account. Cheers.

DarkZeus
  • 59
  • 1
2

IAM role is the solution for you.

You need create role with s3 access permission, if the ec2 instance was started without any role, you have to re-build it with that role assigned.

enter image description here

Refer: Allowing AWS OpsWorks to Act on Your Behalf

BMW
  • 42,880
  • 12
  • 99
  • 116
  • I am using OpsWorks to build my instances. Not sure what IAM role is used for those builds. I will have to check. – hiddenicon Dec 04 '15 at 01:56
  • Yes, you can add role to OpsWorks. – BMW Dec 04 '15 at 11:01
  • When you say 'rebuild' what do you mean? Reboot it? Or build a brand new instance with the same settings? – Sam Redway Nov 26 '18 at 16:29
  • you need terminate the running instance and create a new one. – BMW Nov 27 '18 at 00:32
  • 2
    why do you have to terminate the ec2 instance and attach the role ? you don't need to. you can just attach the role on the fly for an ec2 – Barath Ravichander Apr 17 '19 at 06:17
  • I restarted several times after attaching a dif IAM role, no change, left it on and waited 1 day, restarted and no change. Create a new EC2 instance and assigned the new role straight away and it just worked like @BMW suggested. – Vcoder Dec 08 '20 at 11:06