仅可从我的 ElasticBeanStalk 实例访问 AWS S3 存储桶

Question

I have 1 s3 bucket, 1 elasticbeanstalk instance. Currenly my s3bucket is made public hence its accessible from any domain, even from my localhost. I want that all my s3 bucket resources should be accessible from my EBS instance only where my APP is hosted/running. My app should be able to view these resources and upload new images/resources to this bucket . I am sure somebody myt have done this.

Answer 1

Controlling access to S3 has several ways. The best practice to make something privately accessible is: not to give any rights to access your S3 buckets/files in the bucket policy.

However you should create an IAM role which has either a full access to S3, or limited access to some actions, some buckets.

For every EC2 instances and also to every Elastic Beanstalk environments, you can attache an IAM Role. This role will be automatically served to your instances via instance metadata. This is a safe way to give special rights to your instances.

(Note: This is an AWS security best practice, since AWS will deal with the key rotations on your EC2 boxes.)