Styjun

How can Caller ID be faked?

...and then she held the gun

New Site Design!

Why not make one big CPU core?

What is the color associated with lukewarm?

Are there any rules for identifying what spell an opponent is casting?

When is the phrase "j'ai bon" used?

How can religions without a hell discourage evil-doing?

Idiom for 'person who gets violent when drunk"

Does an African-American baby born in Youngstown, Ohio have a higher infant mortality rate than a baby born in Iran?

How to search for Android apps without ads?

Print the phrase "And she said, 'But that's his.'" using only the alphabet

How did Avada Kedavra get its name?

At zero velocity, is this object neither speeding up nor slowing down?

Manager wants to hire me; HR does not. How to proceed?

Fastest path on a snakes and ladders board

A Tale of Snake and Coffee

For Saintsbury, which English novelists constituted the "great quartet of the mid-eighteenth century"?

Why did the USA sell so many airplanes prior to WW2?

How to avoid offending original culture when making conculture inspired from original

How did the European Union reach the figure of 3% as a maximum allowed deficit?

logarithmic rules with functions

Can an open source licence be revoked if it violates employer's IP?

Digital signature that is only verifiable by one specific person

Can't access S3 bucket using IAM Role from an EC2 instance

How do I limit access to S3 Bucket for particular IAM Role?AWS EC2 IAM role access denied on S3aws s3Client PutObject Access Denied, but CyberDuck can PutObject SuccessfullyPHP Amazon SDK, S3 Bucket Access DeniedAccess key in EC2 instance does not existec2 can't access another s3 file in the same bucketError executing “PutObject” on “https://s3.ap-south-1.amazonaws.com/buckn/uploads/5th.jpg”; AWS HTTP error: Client error: `PUTConnect to s3 bucket using IAM ARN in boto3AWS - Unable to access S3 bucket from EC2 windowsAWS Lambda returns permission denied trying to GetObject from S3 bucket

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

2

I'm trying to download a file from a private S3 bucket using the PHP SDK (on an EC2 instance).

I create an IAM role and attached the AmazonS3FullAccess to it.

I created the S3 bucket and this is the bucket policy:

 "Version": "2012-10-17",
 "Statement": [
 
 "Effect": "Allow",
 "Principal": 
 "AWS": "arn:aws:iam::206193043625:role/MyRoleName"
 ,
 "Action": [
 "s3:PutObject",
 "s3:GetObject",
 "s3:DeleteObject"
 ],
 "Resource": "arn:aws:s3:::config-files/*"
 
 ]

Then on the PHP side I make a curl request to http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRoleName, I get a JSON back instantiate the S3Client and try to download it, but I'm getting this error message:

Error executing "GetObject" on "https://files.s3.us-west-2.amazonaws.com/us-west-2__config.php"; AWS HTTP error: Client error: GET https://files.s3.us-west-2.amazonaws.com/us-west-2__config.php resulted in a 403 Forbidden response:

AccessDenied

Access DeniedC84D80 (truncated...) AccessDenied (client): Access Denied -

AccessDenied

Access DeniedC84D80DE6B2D35FD6sDWIYK98nSH+Oa8lBH7lD91rfHospDeo0jZKFDdo0CaeY8aX6Wb/s2ja5qeYxCBuLwDJ2AqSl0=

Can anyone point me to a direction?

amazon-web-services amazon-s3

share|improve this question

edited Mar 25 at 3:08

John Rotenstein

85.4k895148

asked Mar 25 at 2:54

BGomezBGomez

112

add a comment | 

2

I'm trying to download a file from a private S3 bucket using the PHP SDK (on an EC2 instance).

I create an IAM role and attached the AmazonS3FullAccess to it.

I created the S3 bucket and this is the bucket policy:

 "Version": "2012-10-17",
 "Statement": [
 
 "Effect": "Allow",
 "Principal": 
 "AWS": "arn:aws:iam::206193043625:role/MyRoleName"
 ,
 "Action": [
 "s3:PutObject",
 "s3:GetObject",
 "s3:DeleteObject"
 ],
 "Resource": "arn:aws:s3:::config-files/*"
 
 ]

Then on the PHP side I make a curl request to http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRoleName, I get a JSON back instantiate the S3Client and try to download it, but I'm getting this error message:

Error executing "GetObject" on "https://files.s3.us-west-2.amazonaws.com/us-west-2__config.php"; AWS HTTP error: Client error: GET https://files.s3.us-west-2.amazonaws.com/us-west-2__config.php resulted in a 403 Forbidden response:

AccessDenied

Access DeniedC84D80 (truncated...) AccessDenied (client): Access Denied -

AccessDenied

Access DeniedC84D80DE6B2D35FD6sDWIYK98nSH+Oa8lBH7lD91rfHospDeo0jZKFDdo0CaeY8aX6Wb/s2ja5qeYxCBuLwDJ2AqSl0=

Can anyone point me to a direction?

amazon-web-services amazon-s3

share|improve this question

edited Mar 25 at 3:08

John Rotenstein

85.4k895148

asked Mar 25 at 2:54

BGomezBGomez

112

add a comment | 

I'm trying to download a file from a private S3 bucket using the PHP SDK (on an EC2 instance).

I create an IAM role and attached the AmazonS3FullAccess to it.

I created the S3 bucket and this is the bucket policy:

 "Version": "2012-10-17",
 "Statement": [
 
 "Effect": "Allow",
 "Principal": 
 "AWS": "arn:aws:iam::206193043625:role/MyRoleName"
 ,
 "Action": [
 "s3:PutObject",
 "s3:GetObject",
 "s3:DeleteObject"
 ],
 "Resource": "arn:aws:s3:::config-files/*"
 
 ]

Then on the PHP side I make a curl request to http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRoleName, I get a JSON back instantiate the S3Client and try to download it, but I'm getting this error message:

Error executing "GetObject" on "https://files.s3.us-west-2.amazonaws.com/us-west-2__config.php"; AWS HTTP error: Client error: GET https://files.s3.us-west-2.amazonaws.com/us-west-2__config.php resulted in a 403 Forbidden response:

AccessDenied

Access DeniedC84D80 (truncated...) AccessDenied (client): Access Denied -

AccessDenied

Access DeniedC84D80DE6B2D35FD6sDWIYK98nSH+Oa8lBH7lD91rfHospDeo0jZKFDdo0CaeY8aX6Wb/s2ja5qeYxCBuLwDJ2AqSl0=

Can anyone point me to a direction?

amazon-web-services amazon-s3

share|improve this question

edited Mar 25 at 3:08

John Rotenstein

85.4k895148

asked Mar 25 at 2:54

BGomezBGomez

112

 "Version": "2012-10-17",
 "Statement": [
 
 "Effect": "Allow",
 "Principal": 
 "AWS": "arn:aws:iam::206193043625:role/MyRoleName"
 ,
 "Action": [
 "s3:PutObject",
 "s3:GetObject",
 "s3:DeleteObject"
 ],
 "Resource": "arn:aws:s3:::config-files/*"
 
 ]

share|improve this question

edited Mar 25 at 3:08

John Rotenstein

85.4k895148

asked Mar 25 at 2:54

BGomezBGomez

112

share|improve this question

edited Mar 25 at 3:08

John Rotenstein

85.4k895148

asked Mar 25 at 2:54

BGomezBGomez

112

edited Mar 25 at 3:08

John Rotenstein

85.4k895148

edited Mar 25 at 3:08

John Rotenstein

85.4k895148

asked Mar 25 at 2:54

BGomezBGomez

112

asked Mar 25 at 2:54

BGomezBGomez

112

3 Answers
3

active

oldest

votes

2

There is no need to access 169.254.169.254 directly. The AWS SDK for PHP will automatically retrieve credentials.

Simply create the S3 client without specifying any credentials.

share|improve this answer

answered Mar 25 at 3:09

John RotensteinJohn Rotenstein

85.4k895148

add a comment | 

0

Since you've already provided AmazonS3FullAccess role to your EC2 instance, you need not to do anything else(i.e accessing metadata api). Directly access your S3 client & it shall work as expected from your compute instance.

share|improve this answer

answered Mar 25 at 5:40

Vipin SharmaVipin Sharma

267

add a comment | 

0

For accessing S3 Bucket from EC2 Instance follow the below steps:

* Create an IAM Role with S3 Full Access.
* Launch an EC2 instance with the role attached to it.
* SSH to your EC2 instance with root permissions.
* Type the command: aws s3 ls. It will display all the buckets which are there in S3.

Since the role is attached to the EC2 instance, there is no need to mention the security credentials.

Thanks

share|improve this answer

edited Mar 27 at 2:59

answered Mar 26 at 8:57

Aress SupportAress Support

797111

add a comment | 

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55330696%2fcant-access-s3-bucket-using-iam-role-from-an-ec2-instance%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

2

There is no need to access 169.254.169.254 directly. The AWS SDK for PHP will automatically retrieve credentials.

Simply create the S3 client without specifying any credentials.

share|improve this answer

answered Mar 25 at 3:09

John RotensteinJohn Rotenstein

85.4k895148

add a comment | 

2

There is no need to access 169.254.169.254 directly. The AWS SDK for PHP will automatically retrieve credentials.

Simply create the S3 client without specifying any credentials.

share|improve this answer

answered Mar 25 at 3:09

John RotensteinJohn Rotenstein

85.4k895148

add a comment | 

There is no need to access 169.254.169.254 directly. The AWS SDK for PHP will automatically retrieve credentials.

Simply create the S3 client without specifying any credentials.

share|improve this answer

answered Mar 25 at 3:09

John RotensteinJohn Rotenstein

85.4k895148

share|improve this answer

answered Mar 25 at 3:09

John RotensteinJohn Rotenstein

85.4k895148

answered Mar 25 at 3:09

John RotensteinJohn Rotenstein

85.4k895148

answered Mar 25 at 3:09

John RotensteinJohn Rotenstein

85.4k895148

0

Since you've already provided AmazonS3FullAccess role to your EC2 instance, you need not to do anything else(i.e accessing metadata api). Directly access your S3 client & it shall work as expected from your compute instance.

share|improve this answer

answered Mar 25 at 5:40

Vipin SharmaVipin Sharma

267

add a comment | 

0

Since you've already provided AmazonS3FullAccess role to your EC2 instance, you need not to do anything else(i.e accessing metadata api). Directly access your S3 client & it shall work as expected from your compute instance.

share|improve this answer

answered Mar 25 at 5:40

Vipin SharmaVipin Sharma

267

add a comment | 

Since you've already provided AmazonS3FullAccess role to your EC2 instance, you need not to do anything else(i.e accessing metadata api). Directly access your S3 client & it shall work as expected from your compute instance.

share|improve this answer

answered Mar 25 at 5:40

Vipin SharmaVipin Sharma

267

share|improve this answer

answered Mar 25 at 5:40

Vipin SharmaVipin Sharma

267

answered Mar 25 at 5:40

Vipin SharmaVipin Sharma

267

answered Mar 25 at 5:40

Vipin SharmaVipin Sharma

267

0

For accessing S3 Bucket from EC2 Instance follow the below steps:

* Create an IAM Role with S3 Full Access.
* Launch an EC2 instance with the role attached to it.
* SSH to your EC2 instance with root permissions.
* Type the command: aws s3 ls. It will display all the buckets which are there in S3.

Since the role is attached to the EC2 instance, there is no need to mention the security credentials.

Thanks

share|improve this answer

edited Mar 27 at 2:59

answered Mar 26 at 8:57

Aress SupportAress Support

797111

add a comment | 

0

For accessing S3 Bucket from EC2 Instance follow the below steps:

* Create an IAM Role with S3 Full Access.
* Launch an EC2 instance with the role attached to it.
* SSH to your EC2 instance with root permissions.
* Type the command: aws s3 ls. It will display all the buckets which are there in S3.

Since the role is attached to the EC2 instance, there is no need to mention the security credentials.

Thanks

share|improve this answer

edited Mar 27 at 2:59

answered Mar 26 at 8:57

Aress SupportAress Support

797111

add a comment | 

For accessing S3 Bucket from EC2 Instance follow the below steps:

* Create an IAM Role with S3 Full Access.
* Launch an EC2 instance with the role attached to it.
* SSH to your EC2 instance with root permissions.
* Type the command: aws s3 ls. It will display all the buckets which are there in S3.

Since the role is attached to the EC2 instance, there is no need to mention the security credentials.

Thanks

share|improve this answer

edited Mar 27 at 2:59

answered Mar 26 at 8:57

Aress SupportAress Support

797111

* Create an IAM Role with S3 Full Access.
* Launch an EC2 instance with the role attached to it.
* SSH to your EC2 instance with root permissions.
* Type the command: aws s3 ls. It will display all the buckets which are there in S3.

share|improve this answer

edited Mar 27 at 2:59

answered Mar 26 at 8:57

Aress SupportAress Support

797111

answered Mar 26 at 8:57

Aress SupportAress Support

797111

answered Mar 26 at 8:57

Aress SupportAress Support

797111