11

I am looking to lock down an S3 bucket for security purposes - i'm storing deployment images in the bucket.

What I want to do is create a bucket policy that supports anonymous downloads over http only from EC2 instances in my account.

Is there a way to do this?

An example of a policy that I'm trying to use (it won't allow itself to be applied):

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::[my bucket name]",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:ec2:us-east-1:[my account id]:instance/*"
        }
      }
    }
  ]
}
4
  • Why anonymous access only? Commented Jul 27, 2013 at 5:39
  • Because this is way simpler to implement in PowerShell or batch scripting. I have solved this already by using a really long UserAgent in the request and locking this down this way.
    – Doug
    Commented Jul 27, 2013 at 8:32
  • Can you please post how you did this?
    – David
    Commented Jul 30, 2013 at 10:43
  • 1
    Please see my answer regarding using a Role to allow your instance to download from the bucket without authentication. The Role decorates your instance, so you don't have to have keys/credentials in the instance at all.
    – Atif
    Commented Aug 12, 2016 at 3:12

2 Answers 2

3

Just to clarify how this is normally done. You create a IAM policy, attach it to a new or existing role, and decorate the ec2 instance with the role. You can also provide access through bucket policies, but that is less precise.

Details below:

  1. S3 buckets are default deny except for my the owner. So you create your bucket and upload the data. You can verify with a browser that the files are not accessible by trying https://s3.amazonaws.com/MyBucketName/file.ext. Should come back with error code "Access Denied" in the xml. If you get an error code of "NoSuchBucket", you have the url wrong.

  2. Create an IAM policy based on arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess. Starts out looking like the snip below. Take a look at the "Resource" key, and note that it is set to a wild card. You just modify this to be the arn of your bucket. You have to do one for the bucket and its contents so it becomes: "Resource": ["arn:aws:s3:::MyBucketName", "arn:aws:s3:::MyBucketName/*"]

  3. Now that you have a policy, what you want to do is to decorate your instances with a IAM Role that automatically grants it this policy. All without any authentication keys having to be in the instance. So go to Role, create new role, make an Amazon EC2 role, find the policy you just created, and your Role is ready.

  4. Finally you create your instance, and add the IAM role you just created. If the machine already has its own role, you just have to merge the two roles into a new one for the machine. If the machine is already running, it wont get the new role until you restart.

  5. Now you should be good to go. The machine has the rights to access the s3 share. Now you can use the following command to copy files to your instance. Note you have to specify the region

    aws s3 cp --region us-east-1 s3://MyBucketName/MyFileName.tgz /home/ubuntu

Please Note, the term "Security through obscurity" is only a thing in the movies. Either something is provably secure, or it is insecure.

1

I used something like

{
    "Version": "2012-10-17",
    "Id": "Allow only My VPC",
    "Statement": [
        {
            "Sid": "Allow only My VPC",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject", "s3:ListBucket",
            "Resource": [
                "arn::s3:::{BUCKET_NAME}",
                "arn::s3:::{BUCKET_NAME}/*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:sourceVpc": "{VPC_ID}" OR "aws:sourceVpce": "{VPCe_ENDPOINT}"
                }
            }
        }
    ]
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.