I'm trying to setup an instance profile for an EC2 instance that limits its access to a particular path within an S3 bucket, based on the Name
tag of that EC2 instance. I've gotten a policy that's close, but still doesn't work.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": "arn:aws:s3:::some-bucket",
"Condition": {
"StringLike": {
"s3:prefix": [
"${aws:PrincipalTag/Name}/*"
]
}
}
}
]
}
Turns out that in the case of IAM roles for EC2, the principal is the role itself; not the EC2 instance. Is there any way to use the tags from the EC2 instance in the policy document?
0 Answers