2

Is there a way to let anonymous access to a certain S3 bucket only from my EC2 instances (all of them) within a single AWS account?

  1. I know I can use IAM roles, but I found it's just too many moving parts, and complicates any scripts that have to use the access key/secret key (e.g. rewriting /etc/apt/* lines when it changes). Not to mention there is no way to attach roles to existing instances, which makes it even more pain.

  2. It's also not possible to simply restrict access by using VPC subnet, because S3 bucket access goes via public EC2 interface.

  • You may not like IAM roles, but this is exactly what they're for. It's worth the trouble to get them setup. – ceejayoz Jan 23 '15 at 14:09
  • @ceejayoz It's been a while ago, the problem was that plain apt doesn't support s3, and at the time apt-transport-s3 (github.com/kyleshank/apt-transport-s3) did not support instance metadata (and I couldn't be bothered to write my own apt transport plugin). Since then this project got metadata support and I ditched custom apt repos altogether. – Alex B Jan 23 '15 at 17:32
2

Yeah you have attach a bucket policy to the bucket like this:

{
   "Version":"2012-10-17",
   "Statement":[{
         "Sid":"AddCannedAcl",
         "Effect":"Allow",
         "Principal": {
            "AWS": ["arn:aws:iam::111122223333:root"]
         },
         "Action":[
            "s3:GetObject",
            "s3:GetObjectAcl"
         ],
         "Resource":["arn:aws:s3:::bucket/*"]
      ]
   }]
}

where 111122223333 is your account id

  • "Conditions do not apply to combination of actions and resources in statement - Condition "s3:x-amz-acl" and action "s3:GetObject" I don't think this works this way. String condition is meant to apply as a requirement for new objects (AWS docs give an example with s3:PutObject). – Alex B Jan 23 '14 at 1:12
  • That's exactly where it got this policy from. did you try it with s3:GetObject ? you can remove the Condition clause – Rico Jan 23 '14 at 1:57
  • Yes, adding s3:GetObject gives the above error (which makes sense). Yes, removing any conditions and setting principal to account number is the first thing I tried, it simply removes anonymous access for anyone. – Alex B Jan 23 '14 at 2:27
2

AWS has since added VPC endpoints for S3 access, you can read about the new feature on the AWS blog: https://aws.amazon.com/blogs/aws/new-vpc-endpoint-for-amazon-s3/

EC2 instances running in private subnets of a VPC can now have controlled access to S3 buckets, objects, and API functions that are in the same region as the VPC. You can use an S3 bucket policy to indicate which VPCs and which VPC Endpoints have access to your S3 buckets.

Hope that helps,

Aaron

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.