Static content for AWS EC2 with IAM role

Question

Reading through the / many / resources on how to utilize temporary AWS credentials in a launched EC2 instance, I can't seem to get an extremely simple POC running.

Desired:

1. Launch an EC2 instance
2. SSH in
3. Pull a piece of static content from a private S3 bucket

Steps:

1. Create an IAM role
2. Spin up a new EC2 instance with the above IAM role specified; SSH in
3. Set the credentials using aws configure and the details that (successfully) populated in http://169.254.169.254/latest/meta-data/iam/security-credentials/iam-role-name
4. Attempt to use the AWS CLI directly to access the file

IAM role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::bucket-name/file.png"
    }
  ]
}

When I use the AWS CLI to access the file, this error is thrown:

A client error (Forbidden) occurred when calling the HeadObject operation: Forbidden
Completed 1 part(s) with ... file(s) remaining

Which step did I miss?

Answer 1

For future reference, the issue was in how I was calling the AWS CLI; previously I was running:

aws configure

...and supplying the details found in the auto-generated role profile.

Once I simply allowed it to find its own temporary credentials and just specified the only other required parameter manually (region):

aws s3 cp s3://bucket-name/file.png file.png --region us-east-1

...the file pulled fine. Hopefully this'll help out someone in the future!

Answer 2

Hope this might help some other Googler that lands here.

The

A client error (403) occurred when calling the HeadObject operation: Forbidden

error can also be caused if your system clock is too far off. I was 12 hours in the past and got this error. Set the clock to within a minute of the true time, and error went away.