How can I grant my Amazon EC2 instance access to an Amazon S3 bucket in another AWS account?

Resolution

To grant cross-account access from an EC2 instance to an S3 bucket, set up a trust relationship between two AWS accounts. Use AWS Identity and Access Management (IAM) roles to create the relationship. From the bucket-owner account, create a role that grants S3 permissions. From the EC2 instance owner account, create a role that can assume the bucket owner's role to access the bucket.

Create a role from the bucket-owner account

To create an Identity and Access Management (IAM) role from the bucket-owner account, complete the following steps:

1. Use the bucket-owner account to sign in to the AWS Management Console.

2. Open the IAM console.

3. In the navigation pane, choose Roles, and then choose Create role.

4. For Trusted entity type, choose AWS account.

5. Select Another AWS account, and then enter the account ID of the EC2 instance-owner account.
   Note: Don't select Require external ID or Require MFA unless your security requirements mandate these options.

6. Choose Next.

7. Attach an IAM policy to the role that delegates access to Amazon S3, and then choose Next. For example, the following IAM policy grants s3:GetObject access on objects in the bucket:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:ListBucket"
               ],
               "Resource": [
                   "arn:aws:s3:::amzn-s3-demo-bucket/*",
                   "arn:aws:s3:::amzn-s3-demo-bucket"
               ]
           }
       ]
   }

   Note: Replace amzn-s3-demo-bucket with the name of your bucket. Also, modify the IAM policy based on the Amazon S3 bucket-level and object-level permissions that you require for your use case.

8. For Role name, enter a name for the role.

9. (Optional) Add tags to the role.

10. Choose Create role.

From the bucket-owner account, find the IAM role's Amazon Resource Name (ARN)

To find the IAM role's ARN, complete the following steps:

1. From the IAM console's navigation pane, choose Roles.
2. Choose the IAM role that you created.
3. Note the value that's listed for Role ARN.

From the EC2 instance-owner account, create another role and attach it to the instance

To create another instance profile from the EC2 instance-owner account and attach it to the instance, complete the following steps:

1. Use the EC2 instance-owner account to sign in to the AWS Management Console.

2. Open the IAM console.

3. From the navigation pane, choose Roles, and then choose Create role.

4. For Trusted entity type, choose AWS Service.

5. For Service or use case, choose EC2 and then select your use case.

6. Choose Next.

7. On the Add permissions page, choose Next.

8. For Role name, enter a name for the role.

9. (Optional) Add tags to the role.

10. Choose Create role.

11. From the list of roles, choose the role that you created.

12. For Add permissions, choose Create inline policy.

13. For Policy editor, select JSON, and then enter the following policy:

    {
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::111111111111:role/ROLENAME"
        }]
    }

    Note: Replace arn:aws:iam::111111111111:role/ROLENAME with the ARN of the IAM role that you created in the bucket-owner account.

14. Choose Next.

15. For Name, enter a name for the policy, and then choose Create policy.

16. Attach the IAM role to the instance that you use to access the Amazon S3 bucket.

From the Amazon EC2 instance, create a profile for the role in the CLI config file

Note: If you use SSH and Session Manager to connect to your instances, then you must perform these steps for both the ec2-user and ssm-user. Session Manager is a tool within AWS Systems Manager.

To create a profile for the role in the CLI config file from the instance, complete the following steps:

1. Connect to the instance. For more information, see Connect to your Linux instance using SSH or Connect to your Windows instance using RDP.

2. To determine whether the directory already has a folder named ~/.aws, run the following ls command to list the instance directory:

   ls -l ~/.aws

3. If you find the ~/.aws folder, then proceed to the next step. If you don't find a ~/.aws folder, then run the following mkdir command to create the folder:

   mkdir ~/.aws/

4. In the ~/.aws folder, use a text editor to create a file. Name the file config.

5. In the file, enter the following text to define a profile for the role:

   [profile enterprofilename]
   role_arn = arn:aws:iam::111111111111:role/ROLENAME
   credential_source = Ec2InstanceMetadata

   Note: Replace enterprofilename with your value. Replace arn:aws:iam::111111111111:role/ROLENAME with the ARN of the role that you created in the bucket-owner account.

6. Save the file.

Verify that the instance profile can assume the role

To verify that your instance's role can assume the role in the bucket-owner account, connect to the instance and then run the following command:

aws sts get-caller-identity --profile profilename

Note: Replace profilename with the name of the role that you attached to the instance.

The command returns a response similar to the following one:

"Account": "11111111111",
"UserId": "AROAEXAMPLEID:sessionName",
"Arn": "arn:aws:sts::111111111111:assumed-role/ROLENAME/sessionName"

Confirm that the value for "Arn" matches the ARN of the role that you created in the bucket-owner account.

Verify access to the Amazon S3 bucket

To verify that your instance can access the S3 bucket, connect to the instance and then run the following list command:

aws s3 ls s3://amzn-s3-demo-bucket --profile profilename

Note: Replace amzn-s3-demo-bucket with the name of your bucket and replace profilename with the name that you configured in the config file.

If your instance can successfully access the bucket, then you receive a response similar to the following:

PRE Hello/
2018-08-15 16:16:51 89 index.html

Related information

IAM Tutorial: Delegate access across AWS accounts using IAM roles