title: Use AWS EC2 tag to determine S3 access policy
body: <p>I have multiple AWS EC2 instances that have unique name tags of the form <code>***-manager</code> (three unique characters then <code>-manager</code>). </p>
  
  <p>I have several S3 buckets (and sub-folders in them) with similar 3-character id's in their names that I need to restrict access to depending on which EC2 is asking. </p>
  
  <p>How could I write a single AWS policy to attach to every EC2 that would do the following:</p>
  
  <ol>
  <li><p>The bucket <code>docker.***.mysite.com</code> should only be accessible by the EC2 whose name tag has value <code>***-manager</code>. Action is anything, i.e. <code>*</code>.</p></li>
  <li><p>The folder <code>downloads.mysite.com/***/</code> should only be accessible by the EC2 whose name tag has value <code>***-manager</code>. The action is <code>ListBucket</code> and <code>GetObject</code> with a prefix restriction.</p></li>
  <li><p>The folder <code>downloads.mysite.com/common/</code> should be accessible by any EC2</p></li>
  </ol>
  
  <p>No EC2 should have access to the root <code>downloads.mysite.com/</code> or know anything about it (i.e., can't do any S3 action outside of the <code>common</code> and its <code>***</code> subfolder.</p>
  
  <p>NOTE: If it's not easy/possible to extract the 3-letter id from the EC2 name tag to "pass" to the Resource part of the policy I can easily add a new tag to each EC2 that just has the <code>***</code> as its value - but still have to "pass" that somehow to the Resource in the policy definition.</p>