Is it possible to work with boto3.client('support') if i have instances only in Singapore region?

Question

This is my code,

session = Session(access_key_id='',secret_access_key='',region_name='ap-southeast-1')
conn = session.client('support')
checks = conn.describe_trusted_advisor_checks(language='en')

This gives me following error,

Could not connect to the endpoint URL: "https://support.ap-southeast-1.amazonaws.com/"

As mentioned here, there is only one end point for AWS support,

http://docs.aws.amazon.com/general/latest/gr/rande.html#awssupport_region

So I changed region_name to us-east-1

Now code looks,

session = Session(access_key_id='',secret_access_key='',region_name='us-east-1')
conn = session.client('support')
checks = conn.describe_trusted_advisor_checks(language='en')

But Now i face this error,

botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the DescribeTrustedAdvisorChecks operation: User: abc is not authorized to perform: support:

I have instances only in Singapore regions, why this error is occur, can i use support , even i have instances only in Singapore region and endpoint is us-east-1

Answer 1

AWS Support is not region specific. You need IAM Policy AWSSupportAccess attached to the user.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["support:*"],
      "Resource": "*"
    }
  ]
}

See my answer to a similar question: AccessDeniedException on aws when i'm trying to raise a support ticket

Answer 2

I had to do 3 things to make this work, whilst using the code above:

1. set the region to us-east-1, and
2. assign the AWSSupportAccess role to my user/group
3. enable AWS Business Support

Answer 3

I don't think the error you are getting has anything to do with the fact that your instances are in the ap-southeast-1 region. The error is saying that the credentials you are using when connecting to the support service have not been granted the necessary permissions to perform the operations in the support service.

Check the policy associated with your credentials and make sure it includes an action granting access to the support service.