Is there a way to let anonymous access to a certain S3 bucket only from my EC2 instances (all of them) within a single AWS account?
I know I can use IAM roles, but I found it's just too many moving parts, and complicates any scripts that have to use the access key/secret key (e.g. rewriting /etc/apt/* lines when it changes). Not to mention there is no way to attach roles to existing instances, which makes it even more pain.
It's also not possible to simply restrict access by using VPC subnet, because S3 bucket access goes via public EC2 interface.