Access Amazon S3 from EC2 with an IAM Role

An IAM role lets CS Browser access Amazon S3 from an EC2 instance without storing or distributing long-term AWS access keys on the instance. Attach the role through an instance profile when launching the instance, or attach it to an existing instance.

Grant the role only the Amazon S3 permissions that CS Browser needs. For configuration instructions, see IAM roles for Amazon EC2 in the AWS documentation.

CS Browser retrieves temporary security credentials from the EC2 Instance Metadata Service using IMDSv2. The credentials include an access key ID, secret access key, and session token. AWS rotates them automatically and makes replacement credentials available before the current credentials expire.

To access Amazon S3 from EC2 using an IAM role:

1. Start CS Browser and choose Accounts > Add new account.

   

   The Add New Account dialog will open:

   

2. Enter any name that helps you identify the account in Display name.

3. Choose Amazon S3 via EC2 IAM Role as the account type.

4. Click Add new account.

   You can now choose the newly added account from the Accounts menu:

   

Advanced Account Settings

You may also configure additional settings when adding a new account or editing an existing account.

To open advanced account settings, click the advanced settings link located at the bottom-left corner of the dialog.

The Advanced Account Settings dialog will open:

You can configure the following settings:

Use dual-stack endpoints (IPv4/IPv6) - When selected, CS Browser uses dual-stack endpoints to access Amazon S3 over IPv4 or IPv6.

List all my buckets when account assigned - CS Browser calls the Amazon S3 ListBuckets operation when the account is assigned. This requires the s3:ListAllMyBuckets permission. If the role does not have this permission, clear the option to avoid failed tasks and warnings in the log.

Check CloudFront distributions when account assigned - CS Browser calls the CloudFront ListDistributions operation when the account is assigned. This requires the cloudfront:ListDistributions permission and lets CS Browser mark buckets used as CloudFront origins. If the role does not have this permission, clear the option.

Use Amazon S3 Transfer Acceleration - Uses a Transfer Acceleration endpoint for file transfers. Enable this option only for buckets where Transfer Acceleration is configured.

External Buckets - Enter one bucket or bucket/path value per line. Use / to separate a bucket name from an optional path, for example my-bucket/optional/path.