Understanding EC2 credentials when provisioning server

Question

I'm using Ansible to provision EC2 servers. Here's what I've got so far:

- name: Launch instances
      local_action:
        module: ec2
        key_name: my-key
        aws_access_key: ***
        aws_secret_key: ***
        region: us-west-1
        group: management
        instance_type: m1.small
        image: ami-8635a9b6
        count: 2
        wait: yes
      register: ec2

But I am not authenticating:

You are not authorized to perform this operation.

I imagine its because I don't fully comprehend how the credentials work. I can see in the EC2 console that my-key is the key name for the instance I'm running in (the ansible server), and I know the access_key and secret_key are correct.

I think this is more my not understanding the key_name/keypair and how it works/how to install it, rather than anything related directly to ansible.

Or perhaps this has more to do with the user. I'm running the script as root.

Here is the log:

TASK: [Launch instances] ******************************************************
<127.0.0.1> REMOTE_MODULE ec2 image=ami-8635a9b6 ec2_secret_key=*** ec2_access_key=*** instance_type=m1.small region=us-west-1 key_name=ca-management group=management
<127.0.0.1> EXEC ['/bin/sh', '-c', 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589 && echo $HOME/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589']
<127.0.0.1> PUT /tmp/tmpFgUh1O TO /root/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589/ec2
<127.0.0.1> EXEC ['/bin/sh', '-c', u'LANG=en_US.UTF-8 LC_CTYPE=en_US.UTF-8 /usr/bin/python /root/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589/ec2; rm -rf /root/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589/ >/dev/null 2>&1']
failed: [127.0.0.1 -> 127.0.0.1] => {"failed": true, "parsed": false}
Traceback (most recent call last):
  File "/root/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589/ec2", line 2959, in <module>
    main()
  File "/root/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589/ec2", line 1191, in main
    (instance_dict_array, new_instance_ids, changed) = create_instances(module, ec2)
  File "/root/.ansible/tmp/ansible-tmp-1417702041.0-138277713680589/ec2", line 761, in create_instances
    grp_details = ec2.get_all_security_groups()
  File "/usr/lib/python2.6/site-packages/boto/ec2/connection.py", line 2969, in get_all_security_groups
    [('item', SecurityGroup)], verb='POST')
  File "/usr/lib/python2.6/site-packages/boto/connection.py", line 1182, in get_list
    raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 403 Forbidden
<?xml version="1.0" encoding="UTF-8"?>
<Response><Errors><Error><Code>UnauthorizedOperation</Code><Message>You are not authorized to perform this operation.</Message></Error></Errors><RequestID>f3b9044b-9f41-44dd-9d5e-b7b13215c14a</RequestID></Response>


FATAL: all hosts have already failed -- aborting

embarassingly, it turned out IT gave me the wrong user. Switched to correct user with permissions and voila, it worked. Keeping the question for the useful answers below.

Can you post a full log? Have you tried running the playbook with `-vvvv` to get more debug output? — j0nes, Dec 04 '14 at 08:09

score 1 · Answer 1 · answered Dec 04 '14 at 09:48

1

The error You are not authorized to perform this operation. is a result of the access/privileges you have been assigned in AWS IAM. I am not sure about the ansible part, however, check what permission/policy is allowed/denied on your username in your AWS account.

Also, you can try launching an instance from AWS console and you will receive similar error there as well.

answered Dec 04 '14 at 09:48

slayedbylucifer

22,878
16
94
123

Is that `AWS IAM` account defined by ec2_access_key and ec2_secret_key? – mtyson Dec 04 '14 at 14:03
1

The access/secret keys that you have, are tied to a specific IAM user (account). So, find out which user these access/secret keys belong in AWS IAM users and then find out what permissions are granted/denied to this user. – slayedbylucifer Dec 04 '14 at 15:50

score 1 · Accepted Answer · answered Dec 04 '14 at 15:16

1

  local_action:
    module: ec2
    ec2_access_key: ***
    ec2_secret_key: ***

This varies from what the documentation says. Here are the proper key names.

  local_action:
    module: ec2
    aws_access_key: ***
    aws_secret_key: ***

answered Dec 04 '14 at 15:16

tedder42

23,519
13
86
102

Thought that was going to be it, but same results. – mtyson Dec 04 '14 at 15:28
@mtyson you should unmark my answer as solving your problem, and put this as the answer "embarassingly, it turned out IT gave me the wrong user. Switched to correct user with permissions and voila, it worked." occam's razor certainly pointed that direction. – tedder42 Dec 05 '14 at 00:27
No way, your answer was necessary, if not sufficient. My config wouldn't work without the change. I would mark both answers if I could :) – mtyson Dec 05 '14 at 01:29

Understanding EC2 credentials when provisioning server

2 Answers2