0

I'm new to AWS and was looking for a bucket policy to enable my ec2 servers access to the S3 buckets on the same account. I tried using this policy which enables the account: { "Sid": "AddCannedAcl", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::account-number:root" }, "Action": "s3:", "Resource": "arn:aws:s3:::my-bucket/" } ] } But I got access denied on the ec2.

I've found this: http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Principal "Principal": { "Service": [ "ec2.amazonaws.com", "datapipeline.amazonaws.com" ] } Which supposed to enable specifically the ec2. But when editing the policy I get "We encountered an internal error. Please try again." Any help is appreciated.

  • You can create a new IAM user. provide that user what ever permission you like to give on s3. Then copy the security credentials of that user in ~/.aws/config file or ~/.boto file in your ec2 machine. Then you can access s3 using aws-cli or boto python. – Gaurav Pundir Feb 8 '16 at 12:21
0

Set the bucket policy on the s3 bucket that you want to use, either create a role or use your existing ec2 role to add to the policy.

{
    "Version" : "2008-10-17",
    "Statement" : [{
            "Sid" : "",
            "Effect" : "Allow",
            "Principal" : {
                "AWS" : "arn:aws:iam::000000000000:role/some_role"
            },
            "Action" : [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource" : "arn:aws:s3:::some-s3-bucket/*"
        }, {
            "Sid" : "",
            "Effect" : "Allow",
            "Principal" : {
                "AWS" : "arn:aws:iam::000000000000:role/some_role"
            },
            "Action" : "s3:ListBucket",
            "Resource" : "arn:aws:s3:::some-s3-bucket"
        }
    ]
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.