Grant S3 access to Elastic Beanstalk instances

Question

I'm trying to provision my EC2 instances in Elastic Beanstalk with some ssh keys from a private S3 bucket. Here's a snippet of my .ebextensions/.config:

files:
  "/root/.ssh/id_rsa" :
    mode: "000400"
    ownder: root
    group: root
    source: https://s3-us-west-2.amazonaws.com/<bucket>/<app>_id_rsa

Unfortunately, I'm getting a 403 response from S3. Is there a way to grant access to the EC2 instances using a Security Group? I can't grant each instance access individually as I won't know their IPs before they are scaled. Is there some other way to grant just this Elastic Beanstalk app access? I'm having trouble coming up with a good S3 Bucket Policy...

Answer 1

first click on the tab below

then click on the added role

and add AmazonS3FullAccess access policy

Answer 2

In my case I tried creating a new EC2 role that would include access policy to S3, but could not get it working, as it seems by default this role does not get attached to ec2 instances? Played around with VPC S3 bucket roles, but that only messed up bucket and locked me out. The proper solution was to add the S3 access policy to already existing ElasticBeanstalk role:

aws-elasticbeanstalk-ec2-role

that @chaseadamsio and @tom mentioned, thank you for that.