AWS EC2 access to S3 with IAM role

Question

Scenario: I have an EC2 instance and a S3 bucket under the same account, and my web app on that EC2 wants access to resources in that bucket.

Following official docs, I created an IAM role with s3access and assigned it to the EC2 instance. To my understanding, now my web app should be able to access the bucket. However, after trials, seems I have to add a allowPublicRead bucket policy like this:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucket/*"
        }
    ]
}

Otherwise I got access forbidden.

But why should I use this allowPublicRead bucket policy, since I already granted s3access IAM role to the EC2 instance?

Answer 1

S3 s3:GetObject只允许访问ec2实例中的对象，你想要的是从web-app访问这些对象，这意味着从你的浏览器，在这种情况下，这些图像/对象将呈现给用户浏览器，如果它面向公众的应用程序，您还需要分配AllowPublicRead权限。