title: Static content for AWS EC2 with IAM role
body: <p>Reading through <a href="http://aws.amazon.com/iam/details/manage-roles/">the</a> / <a href="http://blogs.aws.amazon.com/security/post/Tx610S2MLVZWEA/Using-IAM-span-class-matches-roles-span-to-distribute-non-AWS-credentials-to-you">many</a> / <a href="http://blogs.aws.amazon.com/security/post/Tx1XG3FX6VMU6O5/A-safer-way-to-distribute-AWS-credentials-to-EC2">resources</a> on how to utilize temporary AWS credentials in a launched EC2 instance, I can't seem to get an extremely simple POC running.</p>
  
  <p><strong>Desired:</strong></p>
  
  <ol>
  <li>Launch an EC2 instance</li>
  <li>SSH in</li>
  <li>Pull a piece of static content from a private S3 bucket</li>
  </ol>
  
  <p><strong>Steps:</strong></p>
  
  <ol>
  <li>Create an <code>IAM</code> role</li>
  <li>Spin up a new <code>EC2</code> instance with the above <code>IAM</code> role specified; <code>SSH</code> in</li>
  <li>Set the credentials using <code>aws configure</code> and the details that (<strong>successfully</strong>) populated in <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/iam-role-name</code></li>
  <li>Attempt to use the <code>AWS CLI</code> directly to access the file</li>
  </ol>
  
  <p><code>IAM</code> role:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:GetObject"
        ],
        "Resource": "arn:aws:s3:::bucket-name/file.png"
      }
    ]
  }
  </code></pre>
  
  <p>When I use the <code>AWS CLI</code> to access the file, this error is thrown:</p>
  
  <pre><code>A client error (Forbidden) occurred when calling the HeadObject operation: Forbidden
  Completed 1 part(s) with ... file(s) remaining
  </code></pre>
  
  <p>Which step did I miss?</p>