使用云形成将文件从 S3 存储桶复制到 EC2 主目录

Question

I am trying to copy a file from S3 bucket to EC2 home directory. I wrote a script using help from this SOF Answer

However in my case the script is getting executed without any errors but I am unable to see the file getting copied in my instance. Can someone help me figure out what am I missing.

Cloud formation script:

Properties:
  ImageId: !FindInMap [Region2AMI, !Ref 'AWS::Region', 'AMI']
  InstanceType: t2.micro
  SecurityGroups:
    - !Ref WebserverSecurityGroup
  Tags:
    - Key: Name
      Value: Amazon Linux w/ nginx included -2
  KeyName: !Ref KeyName
  UserData:
    'Fn::Base64': !Sub |
      #!/bin/bash -x
      yum update -y aws-cfn-bootstrap
      sudo yum install git -y
      sudo yum update -y
      sudo yum install nginx -y
      sudo service nginx enable
      sudo service nginx start
      mkdir /home/ec2-user/s3-dist
      aws s3 cp s3://ai-dashboard-bucket/dist.zip /tmp
      unzip -d /home/ec2-user/s3-dist /tmp/dist.zip
      /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource EC2Instance --region ${AWS::Region}  --configSets InstallAndConfig

Edit: I checked the logs file and this is error I am getting. I checked the logs and found the following error

aws s3 sync s3://ai-dashboard-bucket/dist.zip /home/ec2-user fatal error: Unable to locate credentials

How do I pass credentials?

Thanks for the help.

Answer 1

Looks like the IAM instance profile doesn't have the permissions to access objects in ai-dashboard-bucket .

Try adding an IAM Instance profile to your EC2 instance

Resources:
  InstanceRole:
    Type: AWS::IAM::Role
    Properties: 
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies: 
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: 's3:Get*'
                Resource: !Sub 'arn:${AWS::Partition}:s3:::ai-dashboard-bucket/*'

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles: 
        - !Ref InstanceRole
  Ec2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap [Region2AMI, !Ref 'AWS::Region', 'AMI']
      InstanceType: t2.micro
      IamInstanceProfile: !GetAtt InstanceRole.Arn  # Using the role created above
      SecurityGroups:
        - !Ref WebserverSecurityGroup
      Tags:
        - Key: Name
          Value: Amazon Linux w/ nginx included -2
      KeyName: !Ref KeyName
      UserData:
        'Fn::Base64': !Sub |
          #!/bin/bash -x
          yum update -y aws-cfn-bootstrap
          sudo yum install git -y
          sudo yum update -y
          sudo yum install nginx -y
          sudo service nginx enable
          sudo service nginx start
          mkdir /home/ec2-user/s3-dist
          aws s3 cp s3://ai-dashboard-bucket/dist.zip /tmp
          unzip -d /home/ec2-user/s3-dist /tmp/dist.zip
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource EC2Instance --region ${AWS::Region}  --configSets InstallAndConfig