使用 ec2 实例标签限制对 S3 存储桶的 ec2 实例访问

Question

I want to allow only specific EC2 instance(s) to have access on specific S3 bucket(s) using EC2 instance tags in the S3 bucket policy.

Want to set the bucket policy runtime during creating the bucket using saltstack.

I tried this with sourceip condition in the S3 bucket policy but I will not be having public IP address of the source EC2 instance.

Answer 1

This is not possible.

When an API call is made to Amazon S3, no information about the originating computer is sent. Therefore, the tags are not accessible.

You could restrict access to a particular EC2 instance by restricting access to an IAM Role that has been assigned to the instance (so it's actually restricting by role, not instance), or you could use a VPC Gateway and restrict the S3 bucket to only work via the VPC Gateway, plus a security policy that restricts access to the VPC Gateway to only the EC2 instance (I think).

The IAM Role would be the preferable method.