Is it possible to execute `aws` cli inside the user_data of an EC2 instance?

Question

I need to be able to copy a tar file from a s3 bucket and untar when I launch my EC2 instances. I basically have this simple user_data:

#/bin/bash
aws s3 cp s3://my-bucket/mytarfile.tar mytarfile.tar > /tmp/output 2>&1

After my instance launches there is no mytarfile.tar anywhere on the instance and the /tmp/output contains the error message:

fatal error: Unable to locate credentials

So I guess it is impossible to use the aws command line in EC2 user_data.

No. I guess that is something I need to do? But I am total AWS noob. How do I do that? — Red Cricket
– Red Cricket, Commented Dec 8, 2020 at 23:05

Marcin · Accepted Answer · 2020-12-08 23:09:30Z

3

By default your buckets and objects in S3 are private. For an instance to be able to access them, you have to explicitly allow such access. This is done by means of IAM roles for instances.

When the IAM role with S3 permissions is attached to the instance, AWS CLI and SDK will be able to automatically fetch the temporary credentials provided by the role to access your S3.

answered Dec 8, 2020 at 23:09

Marcin

241k16 gold badges315 silver badges368 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Red Cricket Over a year ago

Hmm... sorry the AWS docs are confusing to me. So I need to 1) create a role 2) Define which accounts or AWS services can assume the role (I guess that is S3?) 3) Define which API actions and resources the application can use after assuming the role. :( what does that mean?

Marcin Over a year ago

@RedCricket How are you creating the instance? Using CloudFormation?

Red Cricket Over a year ago

Ah! I got it to work. I had to create a "profile" (name my-profile) that has the Policy name "AmazonS3Fullaccess" (I probably could find a read only policy) and when I launch the instance I select that profile in the form.

Collectives™ on Stack Overflow

Is it possible to execute `aws` cli inside the user_data of an EC2 instance?

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related