title: Proper credentials for node & s3
body: <p>My goal is to set up an S3 bucket that my node application can download objects from. I am new to building websites and api requests and have spent a lot of time reading up on AWS's documentation but am really confused.</p>
  
  <p>What are the best ways to set up credentials so that my node application can connect to S3 and download the specific objects I need? Should I be using an iAm role? Are the iAm access keys then just stored on my local .aws/credentials file? So far I have been trying to run the code below with first my personal aws user's access keys, and then an iAm role's access keys, saved into my .aws/credentials file, but I keep getting <code>Access Denied</code> (stack trace below). Am I not setting up my credentials correctly? Thanks!</p>
  
  <pre><code>var AWS = require('aws-sdk');
  
  var s3 = new AWS.S3();
  
  var credentials = new AWS.SharedIniFileCredentials({profile: 'personal-account'});
  AWS.config.credentials = credentials;
  
  var params = { Bucket: "my_bucket", Key: "testing.txt" }
  
  s3.getObject(params, function(err, data) {
    if (err) console.log(err, err.stack);
    else     console.log(data);
  });
  </code></pre>
  
  <p>Stack Trace:</p>
  
  <pre><code> { AccessDenied: Access Denied
  at Request.extractError (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/services/s3.js:577:35)
  at Request.callListeners (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
  at Request.emit (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
  at Request.emit (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:683:14)
  at Request.transition (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:22:10)
  at AcceptorStateMachine.runTo (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/state_machine.js:14:12)
  at /Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/state_machine.js:26:10
  at Request.&lt;anonymous&gt; (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:38:9)
  at Request.&lt;anonymous&gt; (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:685:12)
  at Request.callListeners (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/sequential_executor.js:115:18)
  message: 'Access Denied',
  code: 'AccessDenied',
  region: null,
  time: 2017-10-26T02:01:15.586Z,
  requestId: '10371DCDBBC02508',
  extendedRequestId: '0GC8BZ/39/eFOzWgTedHSFxhFSGBAMcZqxCVAlUxp8YamwBGeGZUZVe7Ti9O/6+BxhUTk9jb4hk=',
  cfId: undefined,
  statusCode: 403,
  retryable: false,
  retryDelay: 75.06631783335284 } 'AccessDenied: Access Denied
  at Request.extractError (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/services/s3.js:577:35)
  at Request.callListeners (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
  at Request.emit (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
  at Request.emit (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:683:14)    
  at Request.transition (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:22:10)    
  at AcceptorStateMachine.runTo (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/state_machine.js:14:12)
  at /Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/state_machine.js:26:10    
  at Request.&lt;anonymous&gt; (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:38:9)    
  at Request.&lt;anonymous&gt; (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/request.js:685:12)    
  at Request.callListeners (/Users/jemery62/dev/jimmyemery_com/node_modules/aws-sdk/lib/sequential_executor.js:115:18)'
  </code></pre>
  
  <h1><strong>UPDATE:</strong></h1>
  
  <p>Hi, I am still unable to get access to this file. My .aws/credentials looks like the following (I am using my personal-account profile, which pulls my IAm role):</p>
  
  <pre><code>[default] ; default profile
  aws_access_key_id = defaultAccessKey
  aws_secret_access_key = defaultSecretAccessKey
  region = us-east-1
  
  [personal-account] ; personal account profile
  aws_access_key_id = personalAccessKey
  aws_secret_access_key = personalSecretAccessKey
  region = us-east-1
  </code></pre>
  
  <p>.aws/config:</p>
  
  <pre><code>[profile corp]
  role_arn = corp-role-arn
  region = us-east-1
  source_profile = default
  </code></pre>
  
  <p>I'm not sure I understand too well how IAm policies work, but I have my IAm role set up with AdministratorAccess and the following profile: </p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "*",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>Do I need to make additional changes to my .aws/config? Am I resourcing my credentials incorrectly or incorrectly trying to call the object I want?</p>
  
  <h1><strong>UPDATE 2:</strong></h1>
  
  <p>I have posted a second question <a href="https://stackoverflow.com/questions/46966678/unable-to-download-s3-objects-with-node">here</a> to clarify exactly the issue I am experiencing at this moment, as I think this post I have made is starting to become a bit confusing.</p>