title: Elastic Beanstalk S3 permission on standard role: still permission denied on file access
body: <p>Trying to get an EB working with S3 bucket.
  Thought i'd followed all the instructions, but just cannot get uploaded pdf to display (currently "permission denied"). I had this working on heroku + S3 earlier so know it works in theory.</p>
  
  <p>Setup</p>
  
  <ul>
  <li>Ruby EB, single instance. created with default app</li>
  <li>added the <a href="https://github.com/thoughtbot/paperclip_demo" rel="nofollow noreferrer" title="paperclip demo app">paperclip demo app</a></li>
  <li>app: paperclipdemo3  env: paperclipdemo3-dev</li>
  <li>instance profile (aws-elasticbeanstalk-ec2-role). standard service
  profile(aws-elasticbeanstalk-service-role)</li>
  <li>attached AmazonS3FullAccess to this rol</li>
  <li>S3 buckets created in same region</li>
  </ul>
  
  <p>Error
  When viewing the uploaded file (pdf) gives
  AccessDeniedAccess Denied5CDDC975006C7C62h3ohBvPu8hXYIZkwLsgF/k0akNuLjyaOpbBzgsxmgtesQ/UJBlOH6phRrsr0tPowNFBFZ7LCI7M=</p>
  
  <p><em>uploaded doc S3 path</em></p>
  
  <p>as per generated html page</p>
  
  <p><a href="https://s3-ap-southeast-2.amazonaws.com/paperclipdemo3bucket1/var/app/current/public/pdf/1/original/testupload_2page_doc1.pdf?1458545227" rel="nofollow noreferrer">https://s3-ap-southeast-2.amazonaws.com/paperclipdemo3bucket1/var/app/current/public/pdf/1/original/testupload_2page_doc1.pdf?1458545227</a></p>
  
  <p>Tried</p>
  
  <ul>
  <li>fixed 'sorry something went wrong' which was endpoints / region config</li>
  <li>adding specific policy as suggested in docs customising bucket names etc., but decided when it didn't work to go simple:</li>
  <li>adding S3 fullaccess to the aws-elasticbeanstalk-ec2-role (which seems the 'simplest' as defined here: <a href="https://stackoverflow.com/questions/26394673/permission-denied-while-elastic-beanstalk-is-retrieving-s3-file" title="SO S3 permissions">"SO S3 permissions"</a>.</li>
  <li>make the S3 bucket world readable (i.e. everyone) and it gives same access denied <strong>surely this should work!?</strong></li>
  </ul>
  
  <p>just cannot get it to work.  bet its something obvious!?</p>
  
  <p>hope someone else can spot quicker than I can, any thoughts appreciated</p>
  
  <p>Ben</p>
  
  <p>EDIT 1 - i've noticed that people talk of seeing <a href="https://stackoverflow.com/questions/26394673/permission-denied-while-elastic-beanstalk-is-retrieving-s3-file">logs in EB console</a>, but all i can do is download the last 100 lines or full EC2 logs. none of my logs mention S3 errors (other than paperclip uploading the the file), there is no return code. 
  I've also noticed my S3 bucket is not writing ANY logs (even though attached a separate logging bucket in same region)</p>
  
  <p><em>Paperclip config</em></p>
  
  <pre><code> config.paperclip_defaults = {
        :storage =&gt; :s3,
        :s3_region =&gt; 'ap-southeast-2',
        :s3_permissions =&gt; :private,
        :s3_protocol =&gt; 'https',
        :s3_host_name =&gt; 's3-ap-southeast-2.amazonaws.com',
        :s3_endpoint =&gt; 's3-ap-southeast-2.amazonaws.com',
        :s3_credentials =&gt; {
          :bucket =&gt; ENV['AWS_BUCKET'],
          :access_key_id =&gt; ENV['AWS_ACCESS_KEY_ID'],
          :secret_access_key =&gt; ENV['AWS_SECRET_ACCESS_KEY'],
        }
      }
  </code></pre>
  
  <p><em>Roles</em></p>
  
  <p><a href="https://i.stack.imgur.com/yrUlx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yrUlx.png" alt="eb roles"></a></p>
  
  <p><em>Policy for Role aws-elasticbeanstalk-ec2-role</em></p>
  
  <p><a href="https://i.stack.imgur.com/OPVjt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OPVjt.png" alt="permissions"></a></p>
  
  <p><em>EB configuration environment variablest</em></p>
  
  <p><a href="https://i.stack.imgur.com/SeHMS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/SeHMS.png" alt="EB Environment Config"></a></p>
  
  <p><em>S3 example uploaded file permissions</em></p>
  
  <p><a href="https://i.stack.imgur.com/gaaU6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gaaU6.png" alt="example S3 uploaded file"></a></p>