title: AWS EC2 IAM role access denied on S3
body: <p>I have launched an EC2 instance with IAM role "webapp". role is attached and i can confirm it using</p>
  
  <pre><code>curl http://169.254.169.254/latest/meta-data/iam/security-credentials/webapp
  {
    "Code" : "Success",
    "LastUpdated" : "2016-01-04T06:44:50Z",
    "Type" : "AWS-HMAC",
    "AccessKeyId" : "xxx",
    "SecretAccessKey" : "xxx",
    "Token" : "xxx",
    "Expiration" : "2016-01-04T12:46:27Z"
  }
  </code></pre>
  
  <p>webapp Role has an attached policy for S3</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "*"
      }
    ]
  }
  </code></pre>
  
  <p>But I am unable to access objects on S3. I am using aws-php-sdk</p>
  
  <pre><code>require_once 'vendor/autoload.php';
  use Aws\S3\S3Client;
  
  $client = S3Client::factory(array('region'  =&gt; 'us-west-2','version'=&gt;'2006-03-01'));
    $result = $client-&gt;getObject(array(
      'Bucket' =&gt; 'test-bkt88767',
      'Key'    =&gt; "file.txt",
    ));
  echo $result['Body'] . "\n";
  </code></pre>
  
  <p>I am getting a 403 forbidden</p>
  
  <pre><code>PHP Fatal error:  Uncaught exception 'Aws\S3\Exception\S3Exception' with message 'Error executing "GetObject" on "https://s3-us-west-2.amazonaws.com/test-bkt88767/file.txt"; AWS HTTP error: Client error: `GET https://s3-us-west-2.amazonaws.com/test-bkt88767/file.txt` resulted in a `403 Forbidden` response:
  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;&lt;Code&gt;AccessDenied&lt;/Code&gt;&lt;Message&gt;Access Denied&lt;/Message&gt;&lt;RequestId&gt;995F9A (truncated...)
   AccessDenied (client): Access Denied - &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;&lt;Code&gt;AccessDenied&lt;/Code&gt;&lt;Message&gt;Access Denied&lt;/Message&gt;&lt;RequestId&gt;995F9AC51CC2164F&lt;/RequestId&gt;&lt;HostId&gt;JPKyfP1LBLW5ky2wH9t2CEjHrKT0tI9zgyXHU/qcJWvBoOwhK7O0dzl1wCjjzV58UhKZVHXvFFg=&lt;/HostId&gt;&lt;/Error&gt;'
  </code></pre>
  
  <p>do I need to change bucket permissions as well? or I am doing something wrong with the conf. of EC2?</p>