{"id":11175,"date":"2013-12-29T02:28:30","date_gmt":"2013-12-28T20:58:30","guid":{"rendered":"https:\/\/tothenewco.pro\/blog\/?p=11175"},"modified":"2014-12-17T09:08:36","modified_gmt":"2014-12-17T03:38:36","slug":"role-based-s3-access-from-a-specific-ec2-instance","status":"publish","type":"post","link":"https:\/\/tothenewco.pro\/blog\/role-based-s3-access-from-a-specific-ec2-instance\/","title":{"rendered":"IAM Role based access to S3 bucket."},"content":{"rendered":"

In one of our projects, we came across a requirement where we were required to fetch a file containing important data from S3 in order to use it. Due to Security concerns we were not keen on storing access keys on the EC2 instance. Which basically meant that we could not configure S3 on that very system as configuring S3 would create a configuration file (.s3cfg) with access keys stored on it.<\/p>\n

The architecture is described in image below.<\/p>\n

\"S3-RoleBasedAccess<\/a><\/p>\n

To accomplish this we followed the steps mentioned below<\/p>\n

    \n
  1. Created an AWS Role named “Worker” which EC2 instances can assume with no specific permission policy.<\/span><\/li>\n

    A role in AWS IAM defines the permissions for service requests and it is assumed by AWS resources like EC2 Instance. The benefit of using roles was that we didn’t have to configure S3 separately on the instance. S3 in this case used ROLE credentials which are temporary and rotated automatically.<\/p>\n

  2. Created an EC2 instance with Role “Worker” and Ip address : 54.254.196.37<\/span><\/li>\n
  3. Added policy to our bucket “com.intelligrape.rolebasedaccess.test” which only allows EC2 instances with Role “worker” and IP address “54.254.196.37” to access the file named “SIPD”.<\/span><\/li>\n<\/ol>\n
     \r\n\"Version\": \"2008-10-17\",\r\n\"Id\": \"Policy1388257451238\",\r\n\"Statement\": [ \r\n      { \"Sid\": \"1232343455\",\r\n        \"Effect\": \"Allow\",\r\n        \"Principal\": { \"AWS\": \"arn:aws:iam::10987654321:role\/worker\" },    \/\/arn:aws:iam::accountnumber:role\/rolename\r\n        \"Action\": \"s3:GetObject\",      \/\/ actions allowed, only allowed to fetch object.\r\n        \"Resource\": \"arn:aws:s3:::com.intelligrape.rolebasedaccess.test\/SIPD\", \/\/\"arn:aws:s3:::bucketname\/file\"\r\n        \"Condition\": {\r\n               \"IpAddress\": {\"aws:SourceIp\": \"54.254.196.37\/32\"}     \/\/ Ip address to allow access to\r\n                     } \r\n               } \r\n         ] \r\n}\r\n<\/code><\/pre>\n
    (Do not forget to remove the comments before putting it to use.)
    \nAnd its done, with this we were able to limit access to S3 bucket to EC2 instance with specific IP address.<\/p>\n
    More about IAM Roles can be learned at AWS Documentation Page.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
    In one of our projects, we came across a requirement where we were required to fetch a file containing important data from S3 in order to use it. Due to Security concerns we were not keen on storing access keys on the EC2 instance. Which basically meant that we could not configure S3 on that […]<\/p>\n","protected":false},"author":16,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":100,"footnotes":""},"categories":[1174],"tags":[248,1256,1167,1254,1255,670],"class_list":["post-11175","post","type-post","status-publish","format-standard","hentry","category-aws-2","tag-aws","tag-bucket","tag-iam","tag-role","tag-role-based-access","tag-s3"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t