title: ec2 roles vs ec2 roles with temporary keys for s3 access
body: <p>So I have a standard Rails app running on ec2 that needs access to s3. I am currently doing it with long-term access keys, but rotating keys is a pain, and I would like to move away from this. It seems I have two alternative options:</p>
  <p>One, tagging the ec2 instance with a role with proper permissions to access the s3 bucket. This seems easy to setup, yet not having any access keys seems like a bit of a security threat. If someone is able to access a server, it would be very difficult to stop access to s3. <a href="http://parthicloud.com/how-to-access-s3-bucket-from-application-on-amazon-ec2-without-access-credentials/" rel="nofollow noreferrer">Example</a></p>
  <p>Two, I can 'Assume the role' using the ruby SDK and STS classes to get temporary access keys from the role, and use them in the rails application. I am pretty confused how to set this up, but could probably figure it out. It seems like a very secure method, however, as even if someone gets access to your server, the temporary access keys make it considerably harder to access your s3 data over the long term.  <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html" rel="nofollow noreferrer">General methodology of this setup.</a></p>
  <p>I guess my main question is which should I go with? Which is the industry standard nowadays? Does anyone have experience setting up STS?</p>
  <p>Sincere thanks for the help and any further understanding on this issue!</p>