Elastic Beanstalk S3通过.ebextensions访问

我在.ebextensions文件夹中有一个简单的文件：

00 myconfig.config

 Resources: AWSEBAutoScalingGroup: Metadata: AWS::CloudFormation::Authentication: S3Access: type: S3 roleName: aws-elasticbeanstalk-ec2-role buckets: my-bucket files: "/tmp/ca-bundle.zip": mode: "000755" owner: root group: root source: https://s3-ap-southeast-2.amazonaws.com/my-bucket/ca/ca-bundle.zip authentication: S3Access 

根据多个答案是授予S3存储区访问aws-elasticbeanstalk-ec2-roleangular色的方式。

但是我继续在/var/log/eb-activity.log得到403错误

• AWS：为什么CloudWatch上的存储桶大小高于使用S3工具？
• 如何撤销Amazon SES SMTP权限
• EC2 vs VPS进行托pipe
• 如何使用命令行工具查看AWS EC2安全组的安全组规则？
• 使用Amazon s3和Cloudfront，设置过期头和caching过期的最佳方法是什么？

 [2015-08-26T01:27:03.544Z] INFO [22320] - [Application update/AppDeployStage0/EbExtensionPreBuild/Infra-EmbeddedPreBuild] : Activity execution failed, because: Failed to retrieve https://s3-ap-southeast-2.amazonaws.com/my-bucket/ca/ca-bundle.zip: HTTP Error 403 : <?xml version="1.0" encoding="UTF-8"?> (ElasticBeanstalk::ExternalInvocationError) 

如果我手动添加S3访问策略到aws-elasticbeanstalk-ec2-roleangular色一切正常，所以我知道我没有在URLS或任何其他的拼写错误，EC2实例是在正确的angular色。

哪里不对？

PS。 我试过或没有'身份validation'设置的files部分。

 { "Id": "Policy1111Blah", "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1440Blah", "Action": [ "s3:GetObject" ], "Effect": "Allow", "Resource": "arn:aws:s3:::my-bucket/*", "Principal": { "AWS": [ "arn:aws:iam::11111111111:role/aws-elasticbeanstalk-ec2-role" ] } } ] }