AWS S3 storage permission denied from Elastic Beanstalk

Question

I'm trying to access to one of my S3 storage buckets from my EC2 instance deployed by ElasticBeanstalk. My EC2 instance belongs to aws-elasticbeanstalk-ec2-role and I have granted this role with AmazonS3FullAccess policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}

Then the bucket policy is as follows:

    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "eb-ad78f54a-f239-4c90-adda-49e5f56cb51e",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::elasticbeanstalk-us-east-XXXXXX/resources/environments/logs/*"
        },
        {
            "Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
            },
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX",
                "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX/resources/environments/*"
            ]
        },
        {
            "Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:DeleteBucket",
            "Resource": "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX"
        }
    ]
}

When I try to access the bucket from an SSH connection or through a script inside .ebextensions I receive an Access Denied 403 error. I tried making the files public and using the same commands and I worked perfectly, but the files I need can't be public.

I think I have the correct policies for both the bucket and the EC2 role. I might be forgetting some detail though.

Any help will be welcomed. Thank you folks in advance!

Exactly which key inside the bucket are you trying to access? What happens if you fire up a separate EC2 box with the role and hit stuff from the command line? — Philip Kendall
@PhilipKendall I've just tried what you told me. I have fired up a EC2 instance with the role and when I do the command aws s3 ls s3:///s3.us-east-2.amazonaws.com/elasticbeanstalk-us-east-2-XXXX/ it returns me the same error. I have tried with other bucket's keys and I received the same. The key I'm trying to access in the bucket is /api/passport. Thanks! — tianoch

marcincuber marcincuber · Accepted Answer · 2019-02-22T17:52:24

So based on my knowledge and previous issues I experienced, your bucket policy is incorrect. It isn't valid because ListBucket and ListBucketVersions actions must be applied to bucket name, not prefix.

Here is my corrected policy that should work;

    {   
        "Version": "2008-10-17",
        "Statement": [
            {
                "Sid": "eb-ad78f54a-f239-4c90-adda-49e5f56cb51e",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
                },
                "Action": "s3:PutObject",
                "Resource": [
                    "arn:aws:s3:::elasticbeanstalk-us-east-XXXXXX/resources/environments/logs/*",
                    "arn:aws:s3:::elasticbeanstalk-us-east-XXXXXX/resources/environments/logs"
                ]
            },
            {
                "Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
                },
                "Action": [
                    "s3:GetObject",
                    "s3:GetObjectVersion"
                ],
                "Resource": [
                    "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX/resources/environments",
                    "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX/resources/environments/*"
                ]
            },
            {
                "Sid": "eb-af163bf3-d27b-4712-b795-anything",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
                },
                "Action": [
                    "s3:ListBucket",
                    "s3:ListBucketVersions"
                ],
                "Resource": [
                    "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX"
                ]
            },
            {
                "Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b",
                "Effect": "Deny",
                "Principal": {
                    "AWS": "*"
                },
                "Action": "s3:DeleteBucket",
                "Resource": "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX"
            }
        ]
    }

Useful docs to reference to for the future -> AWS s3 docs

AWS S3 storage permission denied from Elastic Beanstalk

1 Answers