Introduction

The secure pattern is to let the EC2 instance authenticate to S3 through its IAM instance profile, not through embedded access keys inside cloud-init. Cloud-init then downloads the object using the AWS CLI or SDK over TLS during first boot. If you keep the bucket policy narrow and the instance role minimal, the instance gets only the asset it needs without shipping long-lived secrets in user data.

Use An IAM Role, Not Static Credentials

The first design rule is simple: do not hardcode AWS access keys into cloud-init. User data can leak through logs, snapshots, or operator mistakes. The instance should instead receive temporary credentials from the EC2 metadata service via an attached IAM role.

A minimal policy for one object might look like this:

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Effect": "Allow",
6      "Action": ["s3:GetObject"],
7      "Resource": "arn:aws:s3:::my-private-bucket/bootstrap/app.tar.gz"
8    }
9  ]
10}

Attach that policy to an IAM role, and attach the role to the EC2 instance profile.

Download In Cloud-Init

Once the role is attached, cloud-init can fetch the object during boot.

1#cloud-config
2package_update: true
3packages:
4  - awscli
5
6runcmd:
7  - mkdir -p /opt/myapp
8  - aws s3 cp s3://my-private-bucket/bootstrap/app.tar.gz /opt/myapp/app.tar.gz --region us-east-1
9  - tar -xzf /opt/myapp/app.tar.gz -C /opt/myapp

This works because the AWS CLI automatically uses the instance role credentials. There is no need to pass keys manually.

Keep The Bucket Policy Tight

The IAM role controls what the instance can request. The bucket policy can add another layer of restriction, such as allowing only that role.

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Effect": "Allow",
6      "Principal": {
7        "AWS": "arn:aws:iam::123456789012:role/ec2-bootstrap-role"
8      },
9      "Action": "s3:GetObject",
10      "Resource": "arn:aws:s3:::my-private-bucket/bootstrap/app.tar.gz"
11    }
12  ]
13}

That is much safer than granting broad bucket read access to every instance in the account.

Handle Encryption Normally

S3 downloads already use HTTPS in transit. For at-rest security, use standard S3 server-side encryption or KMS if required by policy. If the object is protected with KMS, the instance role also needs permission to decrypt with that key.

That often means adding kms:Decrypt for the specific KMS key ARN, not just s3:GetObject.

Think About Boot Timing

Cloud-init runs early, but not every dependency is guaranteed to be available instantly. If the artifact is critical to application startup, make sure the service that depends on it waits until the download is complete.

A common pattern is:

1. cloud-init downloads the asset
2. cloud-init writes a systemd unit or extracts the application
3. the application service starts afterward

That is better than assuming the app can race the download and still succeed.

When A Pre-Signed URL Makes Sense

A pre-signed URL can work, but it is usually not the best default inside your own AWS account because the instance role is cleaner and easier to audit. Pre-signed URLs are more useful when the downloader cannot assume an AWS role directly or when access must be granted temporarily across trust boundaries.

Inside a normal EC2 bootstrap flow, IAM roles are the more maintainable design.

Common Pitfalls

• Embedding static AWS credentials in cloud-init user data.
• Giving the instance broad bucket read access when it only needs one object or prefix.
• Forgetting KMS permissions when the S3 object is encrypted with a customer-managed key.
• Starting the application before the artifact download and extraction have completed.
• Using pre-signed URLs by habit when an instance role would be simpler and safer.

Summary

• Use an EC2 instance role so cloud-init can download from S3 without embedded secrets.
• Keep both the IAM policy and the bucket policy narrowly scoped.
• Use aws s3 cp or an SDK call from cloud-init to fetch the private asset.
• Include KMS permissions if the object is encrypted with a customer-managed key.
• Coordinate boot order so application startup depends on the asset being present first.