amazon s3 - Grant S3 access to Elastic Beanstalk instances

Question

I'm trying to provision my EC2 instances in Elastic Beanstalk with some ssh keys from a private S3 bucket. Here's a snippet of my .ebextensions/.config:

files:
  "/root/.ssh/id_rsa" :
    mode: "000400"
    ownder: root
    group: root
    source: https://s3-us-west-2.amazonaws.com/<bucket>/<app>_id_rsa

Unfortunately, I'm getting a 403 response from S3. Is there a way to grant access to the EC2 instances using a Security Group? I can't grant each instance access individually as I won't know their IPs before they are scaled. Is there some other way to grant just this Elastic Beanstalk app access? I'm having trouble coming up with a good S3 Bucket Policy...

Answer 1

You can setup a IAM Role for S3 access and assign the IAM Role to EC2.

IAM Roles for Amazon EC2