How-to
Wiring EC2 to S3 — what IAM Korve actually creates
When you draw a connection from an EC2 instance to an S3 bucket, real IAM roles and policies get created. Here's exactly what, and why it's safer than doing it by hand.
Giving an EC2 instance access to an S3 bucket is one of the most common — and most commonly misconfigured — things in AWS. Do it by hand and you're juggling an IAM role, a trust policy, an instance profile, and a permissions policy across four console screens. It's the kind of task where people reach for s3: on just to make it work, and that's how buckets end up wide open.
Korve makes it a line you draw. Here's what that line does under the hood.
Draw the connection
Put an EC2 node and an S3 node on the canvas. Drag from the EC2 node's edge to the S3 node. That connection is the whole instruction: this instance should be able to use this bucket.
What gets created on deploy
When you deploy, Korve provisions the real chain that AWS requires for an instance to reach a bucket:
- An IAM role with a trust policy that lets EC2 assume it.
- An instance profile wrapping that role, attached to the instance.
- A permissions policy scoped to that specific bucket and its objects — not
*.
The instance can now read and write the bucket using temporary credentials it fetches from the instance metadata service. No access keys are baked into the machine, which is exactly how AWS recommends you do it — and exactly what's tedious enough that people skip it.
Scoped, not wildcarded
The generated policy targets the bucket ARN and its object ARNs. It does not grant s3:* on every bucket in your account. If you later delete the connection and redeploy, Korve unwinds the permission instead of leaving an orphaned role behind. Each connection remembers what it created, so re-deploys don't duplicate or drift.
Why the visual version is safer
The failure mode with hand-rolled IAM isn't ignorance, it's fatigue — the tenth time you write a trust policy you copy-paste the broad one. When the correct, scoped wiring is the default output of drawing a line, the lazy-but-dangerous shortcut stops being the path of least resistance.
See it before it happens
Not sure what a connection will create? Run a dry run from the deploy review. Korve lists every role, policy, and attachment it's about to make, so you approve the IAM changes before anything touches your account.
Related
Build this on a canvas instead of the console.
Start Korve free →