Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using IAM roles to maintain the machines. We now planning to mount the s3 to our ec2 instances and do the processing as per our need. We been using s3fs tool for mounting.

But that doesn't seems to be working with the IAM roles. Are there any ways to make s3fs work with the IAM roles? Did anyone done with this?

Thanks in advance.

share|improve this question

IAM roles require the use of a token in addition to the access key id and secret access key.

This means that s3fs source will need be to be modified from its current state in order to support IAM roles.

Fortunately, s3fs is released under the GPLv2, so you are free to do so.

share|improve this answer
Thanks for the answer. Are there any format in which I need to call the S3 bucktes along with the token? I couln't able to see any call in the code something like Accesskey:SecretKey. – sriram Oct 24 '12 at 9:26
@GroovyUser: Sorry, but I can't understand that question as it is phrased. The actual source code for s3fs needs to be enhanced to support calling the AWS API with additional information. – Eric Hammond Oct 24 '12 at 23:08
Oops! My question is What is the header format of the request to be along with the session token? The code that there already works with by creating the header part of the request with Accesskey:SecretKey. But I need the format for the session tokens too. Or else are there tools that does the same job? – sriram Oct 25 '12 at 2:59

There seems to be an iam_role option in the man page:

iam_role (default is no role) - set the IAM Role that will supply the credentials from the instance meta-data.

A cursory overview of the source suggests that it will get the token and rotate as they expire...

also, see for details on getting these credentials, token, etc yourself

share|improve this answer
This worked for me. I launched an EC2 with server role 'allowS3Full' and then on that server used the command line s3fs -o iam_role='allowS3Full' -o use_cache=/tmp/s3fs mybucket /mnt – Vorsprung Apr 14 at 12:05
Excellent! Good to know that the iam stuff works for s3fs – nterry Apr 14 at 17:10

If you haven't found a solution then I have added iam-role support to s3fs-c at

There are two branches that may be of interest there:-

iam-role: this has the iam role extension

memory-fix: this has the iam role extension and work to reduce the number of memory leaks

I've done basic, but not extensive testing. Importantly the iam-role branch does not have the memory fixes as I am trying to make it a clean diff for a pull-request


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.