Unable to RunInstance with IamInstanceProfile specified

[milosbaran]

Hello,

I'm launching EC2 instances with PHP code without any issue.
But when specify IamInstanceProfile Arn value. I get error
403 Forbidden You are not authorized to perform this operation as soon as I remove it it works fine again.

Has anyone else experienced this issue?

Thanks
Milos

[yenfryherrerafeliz]

Hi @milosbaran, thanks for opening this issue. Are you making sure the role tied up to the profile you are attaching to the EC2 instance has permissions to perform the operation you are trying to do with the SDK?

[milosbaran]

Hi @yenfryherrerafeliz
There are fullEC2 permissions attached to the credentials used.

As I said it's odd and makes no clear sense.

I tried to launch an EC2 instance using the same config block but by specifying Launch Template and I got the same Permissions error.

[yenfryherrerafeliz]

@milosbaran maybe I misunderstood what you are doing here, are you using the AWS SDK for PHP?, or are you getting this error from the console?, if you are getting this error from the console when attaching the IAM profile to the instance, then, the issue is that the user or role which you are using to do this operation does not have the required permissions. So, could you please make sure the user or role that you are logged in from the console has the proper rights to attach that IAM profile?, you could also try creating a new IAM profile, with basic permissions "not admins", and try attaching that profile, and if that works it means that you are trying to grant permissions trough that IAM profile that are over the current user or role you are logged in.

Thanks!

[milosbaran]

Hello @yenfryherrerafeliz
Sorry, maybe I wasn't clear enough. Yes I'm using PHP SDK to start new instances. It's NOT via console. in there it all works as it should.

To show you bits of code
Code that works without any issue and will launch instance for me every time

(
	[MaxCount] => 1
	[MinCount] => 1
	[ImageId] => ami-000b1111c222d33ef
	[InstanceType] => t2.micro
	[KeyName] => EC2-KeyName
	[TagSpecifications] => Array
		(
			[0] => Array
				(
					[ResourceType] => instance
					[Tags] => Array
						(
							[0] => Array
								(
									[Key] => Name
									[Value] => MegaName
								)
						)
				)
			[1] => Array
				(
					[ResourceType] => volume
					[Tags] => Array
						(
							[0] => Array
								(
									[Key] => Name
									[Value] => MegaName
								)
						)
				)
		)
	[NetworkInterfaces] => Array
		(
			[0] => Array
				(
					[DeviceIndex] => 0
					[AssociatePublicIpAddress] => 1
					[DeleteOnTermination] => 1
					[Groups] => Array
						(
							[0] => sg-000abc1d2e3f4gh56
						)
				)
		)
	[BlockDeviceMappings] => Array
		(
			[0] => Array
				(
					[DeviceName] => /dev/sda1
					[Ebs] => Array
						(
							[DeleteOnTermination] => 1
							[Encrypted] => 1
							[SnapshotId] => snap-0e0e0ee00e000e0e0
							[VolumeSize] => 8
							[VolumeType] => gp3
						)
				)
		)
)

And now the code example that will throw an error

(
	[MaxCount] => 1
	[MinCount] => 1
	[ImageId] => ami-000b1111c222d33ef
	[InstanceType] => t2.micro
	[KeyName] => EC2-KeyName
	[IamInstanceProfile] => Array
	(
		[Arn] => arn:aws:iam::000000000000:instance-profile/MegaNameRole
	)
	[TagSpecifications] => Array
		(
			[0] => Array
				(
					[ResourceType] => instance
					[Tags] => Array
						(
							[0] => Array
								(
									[Key] => Name
									[Value] => MegaName
								)
						)
				)
			[1] => Array
				(
					[ResourceType] => volume
					[Tags] => Array
						(
							[0] => Array
								(
									[Key] => Name
									[Value] => MegaName
								)
						)
				)
		)
	[NetworkInterfaces] => Array
		(
			[0] => Array
				(
					[DeviceIndex] => 0
					[AssociatePublicIpAddress] => 1
					[DeleteOnTermination] => 1
					[Groups] => Array
						(
							[0] => sg-000abc1d2e3f4gh56
						)
				)
		)
	[BlockDeviceMappings] => Array
		(
			[0] => Array
				(
					[DeviceName] => /dev/sda1
					[Ebs] => Array
						(
							[DeleteOnTermination] => 1
							[Encrypted] => 1
							[SnapshotId] => snap-0e0e0ee00e000e0e0
							[VolumeSize] => 8
							[VolumeType] => gp3
						)
				)
		)
)

You can see that the only change is adding of IamInstanceProfile variable. Arn is valid.

Error I get back is

Error executing RunInstances on https://ec2.eu-west-2.amazonaws.com; AWS HTTP error: Client error: POST https://ec2.eu-west-2.amazonaws.com resulted in a 403 Forbidden response:
<?xml version=1.0 encoding=UTF-8?>\n<Response><Errors><Error><Code>UnauthorizedOperation</Code><Message>You are not a (truncated...)\n UnauthorizedOperation (client): You are not authorized to perform this operation. Encoded authorization failure message: V-dFvXmM9b...sqk - <?xml version=1.0 encoding=UTF-8?>\n<Response><Errors><Error><Code>UnauthorizedOperation</Code><Message>You are not authorized to perform this operation. Encoded authorization failure message: V-dFvXmM9b...sqk</Message></Error></Errors><RequestID>0654c7e3-4608-4f12-8eaf-c26acf4d06f8</RequestID></Response>

Via console I'm able to launch instance with this Iam Instance profile without any issue.

I will try to create new user / new role and test again

regards
Milos