Setting up an IAM Role for Raspberry Pi (Boto3 - S3)

Creating an IAM role for a Raspberry Pi to access an S3 bucket is not a straightforward process, as IAM roles are typically designed for AWS services. However, you can achieve secure access to your S3 bucket using a combination of IAM user and policies. Here's a recommended approach:

1. Create an IAM user specifically for your Raspberry Pi:

   • Go to the IAM console and create a new user.
   • Do not assign console access, only programmatic access.

2. Create a custom IAM policy:

   • Define a policy that grants only the necessary permissions to access your specific S3 bucket.
   • Limit the actions to only what's required (e.g., s3:GetObject, s3:ListBucket).

3. Attach the custom policy to the IAM user.

4. Generate access keys for the IAM user:

   • In the IAM console, create access keys for this user.
   • Securely store these credentials.

5. On your Raspberry Pi:

   • Set up environment variables for AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_DEFAULT_REGION.
   • Alternatively, use the AWS CLI to configure these credentials locally.

6. Implement additional security measures:

   • Use encryption for your S3 objects.
   • Regularly rotate the access keys.
   • Monitor and audit the usage of these credentials.

7. In your Python script:

   • Use boto3's default credential chain, which will automatically pick up the environment variables or local configuration.

This approach provides a balance between security and practicality for a Raspberry Pi scenario. While it's not using a role directly, it follows the principle of least privilege and avoids using root credentials.

Remember to keep your access keys secure and never commit them to version control systems. Regularly review and update your IAM policies and access keys to maintain security.

Sources
Upload files into a S3 since a external Server | AWS re:Post
vpc endpoint interface and S3 | AWS re:Post

Hello.

In your case, it fits the use case described in the following document, so I think it is fine to use the access key of an IAM user.
However, as stated in the documentation, if you use an IAM user, I recommend that you configure it to allow only the actions required for operations on S3.
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#update-access-keys

Update access keys when needed for use cases that require long-term credentials

Also, when creating an IAM user there is a setting called "Enable console access". By disabling this setting it is possible to prevent the IAM user for Raspberry Pi from accessing the management console.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html

Alternatively, you can use IAM Roles Anywhere to access AWS services using temporary credentials.
In this case, the access key for the IAM user is not required, so access can be implemented using an IAM role.
However, please be aware that authentication methods using ACM Private CA can be expensive.
If you use a certificate from your own private CA, you don't need to worry about the cost.
https://aws.amazon.com/jp/blogs/security/extend-aws-iam-roles-to-workloads-outside-of-aws-with-iam-roles-anywhere/