amazon web services - Access Denied to an S3 object in Elastic Beanstalk configuration setting -

i trying configure 'source' parameter in elastic beanstalk application config file. relevant source bz2 file have uploaded in new s3 bucket. example, name of bucket created 'abc' , file name 'mysource.tar.bz2'. relevant line in config file looks this:

source:      /usr/bin/mysource: https://s3-us-west-2.amazonaws.com/abc/mysource.tar.bz2 

when trying deploy code, there error , on checking log, shows 'accessdenied' file.

i have created instance profile (role) in aws iam console trust relationship amazon ec2 , have set access required bucket.

the permission in role looks this:

{   "statement": [     {       "sid": "stmt13674962346",       "action": [       "s3:*"       ],       "effect": "allow",       "resource": [       "arn:aws:s3:::abc/*"      ]     }   ] } 

have tried setting resource *:

"resource": "*" 

but still accessdenied error.

if change permission s3 file 'mysource.tar.bz2' making public, works.

so, there way working without having make s3 file public? settings role permission incorrect? or there other way achieve this?

it's not possible access protected aws assets elastic beanstalk using files or source keys. these commands processed in basic way , not read instance metadata, cannot extract aws credentials (as far know).

my solution problem create iam role appropriate permissions, install recent aws tools, , use commands key download , extract file. key aws command-line tools automatically extract aws credentials instance.

commands:   01-install-awscli:     command: easy_install awscli   02-download-s3-asset:     command: aws s3 cp --region us-east-1 s3://abc/mysource.tar.bz2 .   03-extract-file:     command: tar xvjf mysource.tar.bz2 destination/ 

commands executed in source directory of project, change paths necessary or use cwd option change commands run from.