policy

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Action": [ "s3:getobject" ], "Resource": [ "arn:aws:s3:::<s3>/*" ] } ] }

s3 policy

{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:role/<role>", "Service": "ec2.amazon.com" }, "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::<s3>/*" } ] }