How should an app running on EC2 or ECS access S3?
Options
- Hardcode access keys in the code of the application
- Use an IAM role on the instance or task, with temporary credentials (Correct option)
- Make the bucket public so that no credentials are needed
- Email the access keys to the ops team to configure them
Answer
Use an IAM role attached to the instance/task, which provides temporary rotating credentials
Why
IAM (Identity and Access Management) controls who can do what in AWS.
Instead of storing permanent keys, you attach a role to the server or container. The AWS SDK automatically gets short-lived credentials from it, rotated for you.
Give the role only what it needs, e.g. read/write on one bucket (least privilege).
Remember
AWS access from your servers → IAM roles, not stored keys.