AWS S3 Bucket Policy to allow read-only access from my instances

Question

Is it possible to create an S3 bucket policy that allows read-only access from my EC2 instances? I tried a bunch of things, but I can't figure out what to use for the principal.

Answer 1

The principal will be the role.

ie: arn:aws:iam::accountnumber:role/rolename

This post describes how to do it:

http://www.tothenew.com/blog/role-based-s3-access-from-a-specific-ec2-instance/

just ignore the part about the IP address since you won't need it.

Answer 2

您应该为实例分配一个角色，该角色允许访问S3存储桶。

Answer 3

The issue is that:

1. You need both the role itself and the assumed-role in your not_principals clause
2. wildcards are not allowed in principal specifications

This explains how to use userid instead:

https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/