Mount Amazon S3 on EC2 with an IAM Role

An IAM role lets TntDrive access Amazon S3 from an Amazon EC2 instance without storing or distributing long-term AWS access keys on the instance. Attach the role through an instance profile when you launch the instance, or attach it to an existing instance.

Grant the role only the Amazon S3 permissions that TntDrive needs for the buckets and operations you intend to use. See IAM roles for Amazon EC2 and Identity-based policies for Amazon S3 in the AWS documentation.

TntDrive retrieves a temporary access key ID, secret access key, and session token from the EC2 Instance Metadata Service using IMDSv2. AWS rotates these credentials automatically and provides replacements before the current credentials expire. TntDrive refreshes them when fewer than five minutes remain.

Requirements for the EC2 instance

• Install and run TntDrive on the Amazon EC2 instance that has the IAM role attached.
• Attach an instance profile containing an IAM role with the required Amazon S3 permissions.
• Keep the Instance Metadata Service endpoint enabled. TntDrive uses IMDSv2 and contacts 169.254.169.254 directly without using a proxy.
• Use this account type for EC2 instances in standard AWS Regions. In AWS GovCloud (US), select Amazon S3 GovCloud via EC2 IAM Role instead. See How to Mount Amazon S3 Buckets in AWS GovCloud (US).

Add an EC2 IAM role account to TntDrive

1. Start TntDrive Dashboard and choose Accounts > Add new account...

   

2. The Add New Account dialog will open.

   

3. Enter a descriptive account name.

4. Choose Amazon S3 via EC2 IAM Role as the account type.

5. Keep Use secure transfer (SSL/TLS) enabled.

6. Click Add new account.

You can now add a new mapped drive and select this account. TntDrive will obtain temporary credentials from the IAM role attached to the EC2 instance.