Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

AWS S3 Bucket Access from EC2

I need to fire up an S3 bucket so my EC2 instances have access to store image files to it. The EC2 instances need read/write permissions. I do not want to make the S3 bucket publicly available, I only want the EC2 instances to have access to it.

The other gotcha is my EC2 instances are being managed by OpsWorks and I can have may different instances being fired up depending on load/usage. If I were to restrict it by IP, I may not always know the IP the EC2 instances have. Can I restrict by VPC?

Do I have to make my S3 bucket enabled for static website hosting? Do I need to make all files in the bucket public as well for this to work?

like image 895
hiddenicon Avatar asked Dec 03 '15 04:12

hiddenicon


People also ask

Can AWS EC2 access S3 bucket without access key?

You can access an S3 bucket privately without authentication when you access the bucket from an Amazon Virtual Private Cloud (Amazon VPC). However, make sure that the VPC endpoint used points to Amazon S3.

Can we mount S3 bucket to EC2 instance?

A S3 bucket can be mounted in a AWS instance as a file system known as S3fs. S3fs is a FUSE file-system that allows you to mount an Amazon S3 bucket as a local file-system. It behaves like a network attached drive, as it does not store anything on the Amazon EC2, but user can access the data on S3 from EC2 instance.

How do I give access to AWS S3 bucket?

To set ACL permissions for a bucketSign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/ . In the Buckets list, choose the name of the bucket that you want to set permissions for. Choose Permissions. Under Access control list, choose Edit.


2 Answers

You do not need to make the bucket public readable, nor the files public readable. The bucket and it's contents can be kept private.

Don't restrict access to the bucket based on IP address, instead restrict it based on the IAM role the EC2 instance is using.

  1. Create an IAM EC2 Instance role for your EC2 instances.
  2. Run your EC2 instances using that role.
  3. Give this IAM role a policy to access the S3 bucket.

For example:

{
  "Version": "2012-10-17",
  "Statement":[{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::my_bucket",
                 "arn:aws:s3:::my_bucket/*"]
    }
  ]
} 
  1. If you want to restrict access to the bucket itself, try an S3 bucket policy.

For example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::111122223333:role/my-ec2-role"]
      },
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my_bucket",
                   "arn:aws:s3:::my_bucket/*"]
    }
  ]
}

Additional information: http://blogs.aws.amazon.com/security/post/TxPOJBY6FE360K/IAM-policies-and-Bucket-Policies-and-ACLs-Oh-My-Controlling-Access-to-S3-Resourc

like image 69
Matt Houser Avatar answered Oct 30 '22 23:10

Matt Houser


This can be done very simply. Follow the following steps:

  • Open the AWS EC2 on console.
  • Select the instance and navigate to actions.
  • Select instances settings and select Attach/Replace IAM Role
  • Create a new role and attach S3FullAccess policy to that role.

When this is done, connect to the AWS instance and the rest will be done via the following CLI commands:

  • aws s3 cp filelocation/filename s3://bucketname

Please note... the file location refers to the local address. And the bucketname is the name of your bucket. Also note: This is possible if your instance and S3 bucket are in the same account. Cheers.

like image 34
DarkZeus Avatar answered Oct 30 '22 22:10

DarkZeus