Give EC2 instance temporary S3 permission without changing instance profile - amazon-web-services

Question

I have a Lambda function to SendCommand from an SSM Document to an EC2 instance whenever the instance changes its state to running. The Document basically downloads a package from an S3 bucket from another account and installs it on the instance. The bucket policy allows everyone to List* and Get*.
The issue is that I'm not allowed to modify the instance profile to give it S3 permission. So the question is how do I get this specific package on the instance without changing the instance profile? Is there a different approach to this?
Bucket policy
{
"Version": "2012-10-17",
"Id": "Policy111",
"Statement": [
{
"Sid": "NoDelete",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:DeleteBucket",
"Resource": "arn:aws:s3:::<bucket_name>"
},
{
"Sid": "Stmt111",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:List*",
"Resource": "arn:aws:s3:::<bucket_name>",
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "o-111"
}
}
},
{
"Sid": "list",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:List*",
"Resource": "arn:aws:s3:::<bucket_name>/*",
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "o-111"
}
}
},
{
"Sid": "Stmt1111",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:Get*",
"Resource": "arn:aws:s3:::<bucket_name>",
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "o-111"
}
}
},
{
"Sid": "get",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:Get*",
"Resource": "arn:aws:s3:::<bucket_name>/*",
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "o-111"
}
}
}
]
}
SSM Document
"inputs": {
"runCommand": [
"aws s3 cp {{S3Path}} .",
"sudo yum install {{PackageName}} -y"
]
}