AWS S3 Bucket Access from EC2

Question

I need to fire up an S3 bucket so my EC2 instances have access to store image files to it. The EC2 instances need read/write permissions. I do not want to make the S3 bucket

Answer 1

You do not need to make the bucket public readable, nor the files public readable. The bucket and it's contents can be kept private.

Don't restrict access to the bucket based on IP address, instead restrict it based on the IAM role the EC2 instance is using.

1. Create an IAM EC2 Instance role for your EC2 instances.
2. Run your EC2 instances using that role.
3. Give this IAM role a policy to access the S3 bucket.

For example:

{
  "Version": "2012-10-17",
  "Statement":[{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::my_bucket",
                 "arn:aws:s3:::my_bucket/*"]
    }
  ]
} 

4. If you want to restrict access to the bucket itself, try an S3 bucket policy.

For example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::111122223333:role/my-ec2-role"]
      },
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my_bucket",
                   "arn:aws:s3:::my_bucket/*"]
    }
  ]
}

Additional information: http://blogs.aws.amazon.com/security/post/TxPOJBY6FE360K/IAM-policies-and-Bucket-Policies-and-ACLs-Oh-My-Controlling-Access-to-S3-Resourc