title: Access denied error when sending curl to S3 bucket
body: <p>I am trying to send a curl request to an S3 bucket from my EC2 to retrieve a specific object within the bucket:</p>
  <p>I want to create a transparent proxy with caching implemented by nginx so the aws cli wont work for this.</p>
  <p>The EC2 instance (Linux machine) works as a proxy server with NGINX to send HTTP requests to the bucket for caching purposes, I do not have an SSL cert on this instance.</p>
  <p>The bucket only contains images.</p>
  <p>The curl request looks like this:</p>
  <pre><code>curl my-bucket.s3.eu-west-1.amazonaws.com/1450/1349/5467_1012.jpg
  </code></pre>
  <p><strong>But I get an Access Denied error</strong></p>
  <p>I have attached a full read access policy to my EC2 instance role.</p>
  <p>Here is my bucket policy:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Id&quot;: &quot;MediaStorageBucketPolicy&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::${current_account}:root&quot;
              },
              &quot;Action&quot;: [
                  &quot;s3:GetObject&quot;,
                  &quot;s3:ListBucket&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;${media_storage_bucket_arn}&quot;,
                  &quot;${media_storage_bucket_arn}/*&quot;
              ]
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::${current_account}:root&quot;
              },
              &quot;Action&quot;: [
                  &quot;s3:PutObject&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;${media_storage_bucket_arn}&quot;,
                  &quot;${media_storage_bucket_arn}/*&quot;
              ]
          },
  
      {
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Principal&quot;: {
              &quot;AWS&quot;: [
                  &quot;arn:aws:I am::&lt;account number&gt;:role/ssm-ec2-service-role&quot;
              ]
          },
          &quot;Action&quot;: [
              &quot;s3:GetObject&quot;,
              &quot;s3:ListBucket&quot;
          ],
          
          &quot;Resource&quot;: [
              &quot;${media_storage_bucket_arn}&quot;,
              &quot;${media_storage_bucket_arn}/*&quot;
          ]
      }
  
  
      ]
  }
  </code></pre>
  <p>Can this be achieved without making the bucket public?</p>