amazon-web-servicesamazon-s3amazon-ec2

Only allow EC2 instance to access static website on S3

I have a static website hosted on S3, I have set all files to be public. Also, I have an EC2 instance with nginx that acts as a reverse proxy and can access the static website, so S3 plays the role of the origin.

What I would like to do now is set all files on S3 to be private, so that the website can only be accessed by traffic coming from the nginx (EC2).

So far I have tried the following. I have created and attached a new policy role to the EC2 instance with

Policies Granting Permission: AmazonS3ReadOnlyAccess

And have rebooted the EC2 instance.

I then created a policy in my S3 bucket console > Permissions > Bucket Policy

{
    "Version": "xxxxx",
    "Id": "xxxxxxx",
    "Statement": [
        {
            "Sid": "xxxxxxx",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXXXXXX:role/MyROLE"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::XXX-bucket/*"
        }
    ]
}

As principal I have set the ARN I got when I created the role for the EC2 instance. 

"Principal": {
                "AWS": "arn:aws:iam::XXXXXXXXXX:role/MyROLE"
            },

However, this does not work, any help is appreciated.

Solution

  • If the Amazon EC2 instance with nginx is merely making generic web requests to Amazon S3, then the question becomes how to identify requests coming from nginx as 'permitted', while rejecting all other requests.

    One method is to use a VPC Endpoint for S3, which allows direct communication from a VPC to Amazon S3 (rather than going out an Internet Gateway).

    A bucket policy can then restrict access to the bucket such that it can only be accessed via that endpoint.

    Here is a bucket policy from Example Bucket Policies for VPC Endpoints for Amazon S3:

    The following is an example of an S3 bucket policy that allows access to a specific bucket, examplebucket, only from the VPC endpoint with the ID vpce-1a2b3c4d. The policy uses the aws:sourceVpce condition key to restrict access to the specified VPC endpoint.

    {
   "Version": "2012-10-17",
   "Id": "Policy",
   "Statement": [
     {
       "Sid": "Access-to-specific-VPCE-only",
       "Action": "s3:*",
       "Effect": "Allow",
       "Resource": ["arn:aws:s3:::examplebucket",
                    "arn:aws:s3:::examplebucket/*"],
       "Condition": {
         "StringEquals": {
           "aws:sourceVpce": "vpce-1a2b3c4d"
         }
       },
       "Principal": "*"
     }
   ]
}

    So, the complete design would be: