EC2 Instance Profile Missing — IAM Role Access Denied

Quick Answer

The application cannot read from S3 because an IAM role by itself is just a set of permissions sitting on the shelf; an EC2 instance can only use that role's credentials if the role has been attached to the instance through an IAM instance profile. Without that association, the instance has no way to assume the role and never receives temporary credentials, so from the application's point of view it looks exactly like it has no permissions, even though the role itself is correctly configured with s3:GetObject. This is worth being precise about: the role holds the policy and permissions, but the instance profile is the mechanism that actually connects that role to a running EC2 instance and makes its credentials retrievable from the instance metadata service. The other explanations fit less well: a bucket policy denying access is possible in general but weaker once the role's own policy is confirmed correct, IAM policies attach to roles and users rather than instances directly so that isn't the gap, and a user data script has no bearing on IAM permissions since it only runs commands at boot. Whenever an EC2-to-AWS-service permissions problem describes a role with an apparently correct policy that still isn't working, check first whether the role is attached to the instance via an instance profile, since a policy that's never assumed cannot grant anything.