title: Unable to access S3 file with IAM role from EC2
body: <p>I created an IAM role 'test' and assigned to an EC2 instance. And I created a S3 bucket with bucket policy </p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "Policy1475837721706",
      "Statement": [
          {
              "Sid": "Stmt1475837720370",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::770370070203:role/test"
              },
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::test-role-123/*"
          }
      ]
  }
  </code></pre>
  
  <p>From EC2, I got the AccessKey and SecretKey from this <a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials" rel="nofollow">AWS article</a> by sending a curl request to </p>
  
  <pre><code>curl http://169.254.169.254/latest/meta-data/iam/security-credentials/&lt;role-name&gt;
  </code></pre>
  
  <p>Using the response from the above, I wrote a node script to make a request to the resource in the bucket</p>
  
  <pre><code>var AWS = require('aws-sdk');
  
  var d = {
      "Code" : "Success",
      "LastUpdated" : "2016-10-07T12:28:09Z",
      "Type" : "AWS-HMAC",
      "AccessKeyId" : "ASIAIMJBHYLH6GWOWNMQ",
      "SecretAccessKey" : "7V/k5nvFdhXOcT+nhYjGqHM4QmUWjNBUM1ERJQJs",
      "Token" : "FQoDYXdzEO7//////////wEaDGG+SgxD4Es4Z1RBZCKzAz855JuKfm8s7LDcP5T9TGvDdJELsYTzPi47HJ9Q5oaK8OTb0Us0RjvpGW278Mb1gg1dNip1VD2N/GW5/1TFC6xhNpnnZ9+LNkJAwVVZg5raGM91k56X/VOA++/5WivSpO4jWg8fZDibivVyHuoMJJTkurFtEXrweDOCqpiabypTCc5jFtX8NfQuHubwl4C1jp2pMasVS1jwhjU72TA8Pn9EsIIvh8JXDC1dVfppwnslolAeJyOOAHdL1AQSs3nI6IvPCtKhBjtDaVuoiH/lHrnKrw6AeMHoTYQay4wOYRnE4ffngtksekZEULXvERWE4NCs3leXGMqrdzOr8xdZ9m0j3IkshqSS56fkq6E9JtLhSVGyy44ELrL7kYW/dpHE03V+dwQPXMhRafjsVsPD7sUnBfH/+4yyL0VDX1vlFRKbRi50i/Eqvxsb9bcSTsE0W5yWmOWR8reTTYWcWyQXGvxKVYVxLWZKVRfmNfx6IX2sqan7e7pjCtUrqXB1TBMpXdy8KSH9qoJtNAQTYBXws7oFLYY+F2esnNCma0bdNcCeAQ6t/6aPfUdpdLgv8BcGciZxayiqqd6/BQ==",
      "Expiration" : "2016-10-07T18:51:57Z"
  };
  AWS.config.accessKeyId = d.AccessKeyId;
  AWS.config.secretAccessKey = d.SecretAccessKey;
  var s3params = {Key: "test.json", Bucket:"test-role-123"};
  AWS.config.region = 'ap-south-1';
  
  var s3 = new AWS.S3();
  
  s3.getSignedUrl('getObject', s3params, function(err, url) {
      console.log(url);
  });
  </code></pre>
  
  <p>On running this code I am getting the signed url. But this is giving an InvalidAccessKeyId error. I doubted if the s3 bucket policy is wrong so tried to get with similar policy with an IAM user credentials. It is completely working.</p>
  
  <p>Any hints or suggestions are welcome.</p>