Need Help using IAM Role to Grant S3 Access to Application on EC2 Instance
Budget: $15 – $25 USD
We would like to use the strategy described at the URL below to grant S3 access to an EC2 application:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html
We want to avoid the alternative of storing IAM access keys on the EC2 instance.
Below are the results we are getting so far. At this point we are stuck.
It is probably something simple we are missing.
If you have done this before, you may already see the problem.
Role ARN
arn:aws:iam::123456789012:role/EC2-Matlab-Instance-Role
Instance Profile ARNs</span>
arn:aws:iam::123456789012:instance-profile/EC2-Matlab-Instance-Role
===== PERMISSIONS =====
Role ARN: arn:aws:iam::123456789012:role/EC2-Matlab-Instance-Role
Instance Profile ARN: arn:aws:iam::123456789012:instance-profile/EC2-Matlab-Instance-Role
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3ObjectAccess",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketPolicy",
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::data-service-bucket"
},
{
"Sid": "AllowIPToAssumeRole",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "*"
}
]
}
===== TRUST RELATIONSHIP =====
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
===== EC2 IAM ROLE ATTACHED =====
Instance ID: i-043430c6754f00000
IAM Role: EC2-Matlab-Instance-Role
===== EC2 AWS CLI CONFIG FILE =====
[default]
region = us-east-2
output = json
role_arn = arn:aws:iam::123456789012:instance-profile/EC2-Matlab-Instance-Role
credential_source = Ec2InstanceMetadata
===== EC2 AWS CLI RESULT =====
C:\Users\tester> aws s3 ls data-service-bucket
An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
C:\Users\tester> aws ec2 describe-iam-instance-profile-associations
{
"IamInstanceProfileAssociations": []
}
C:\Users\tester> aws iam get-instance-profile --instance-profile-name EC2-Matlab-Instance-Role
An error occurred (NoSuchEntity) when calling the GetInstanceProfile operation: Instance Profile EC2-Matlab-Instance-Role cannot be found.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html
We want to avoid the alternative of storing IAM access keys on the EC2 instance.
Below are the results we are getting so far. At this point we are stuck.
It is probably something simple we are missing.
If you have done this before, you may already see the problem.
Role ARN
arn:aws:iam::123456789012:role/EC2-Matlab-Instance-Role
Instance Profile ARNs</span>
arn:aws:iam::123456789012:instance-profile/EC2-Matlab-Instance-Role
===== PERMISSIONS =====
Role ARN: arn:aws:iam::123456789012:role/EC2-Matlab-Instance-Role
Instance Profile ARN: arn:aws:iam::123456789012:instance-profile/EC2-Matlab-Instance-Role
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3ObjectAccess",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketPolicy",
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::data-service-bucket"
},
{
"Sid": "AllowIPToAssumeRole",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "*"
}
]
}
===== TRUST RELATIONSHIP =====
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
===== EC2 IAM ROLE ATTACHED =====
Instance ID: i-043430c6754f00000
IAM Role: EC2-Matlab-Instance-Role
===== EC2 AWS CLI CONFIG FILE =====
[default]
region = us-east-2
output = json
role_arn = arn:aws:iam::123456789012:instance-profile/EC2-Matlab-Instance-Role
credential_source = Ec2InstanceMetadata
===== EC2 AWS CLI RESULT =====
C:\Users\tester> aws s3 ls data-service-bucket
An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
C:\Users\tester> aws ec2 describe-iam-instance-profile-associations
{
"IamInstanceProfileAssociations": []
}
C:\Users\tester> aws iam get-instance-profile --instance-profile-name EC2-Matlab-Instance-Role
An error occurred (NoSuchEntity) when calling the GetInstanceProfile operation: Instance Profile EC2-Matlab-Instance-Role cannot be found.