Quantcast
Channel: Active questions tagged amazon-ec2 - Stack Overflow
Viewing all articles
Browse latest Browse all 29547

Access Issue with Lambda trying to launch ec2 instance

$
0
0

I have created a lambda function through which I want to launch an ec2 instance using pre-baked AMI along with a bunch of other tags.

Lambda function:

require 'json'
require 'aws-sdk'

def lambda_handler(event:, context:)

  client = Aws::EC2::Client.new(region: 'us-west-2')
  images = client.describe_images({
    filters: [
      {
        name: "tag:metatag",
        values: ["app"],
      },
    ],
    owners: ["<owner_id>"],
    dry_run: false,
  }).images

  latest_image_id = images.first.image_id

  ec2 = Aws::EC2::Resource.new(region: 'us-west-2')
  instance = ec2.create_instances({
    image_id: latest_image_id,
    min_count: 1,
    max_count: 1,
    key_name: '<key-name>',
    security_group_ids: ['ApplicationSG'],
    instance_type: 't3.large',
    subnet_id: '<subnet>',
    iam_instance_profile: {
      arn: '<arn>'
    }
  })

  instance.batch_create_tags({ tags: [
    { key: 'Name', value: 'testapp08' }
   ]})

    { statusCode: 200, body: JSON.generate("latest_image_id:#{latest_image_id}, instance: #{instance.inspect}") }
end

Created a role with an inline policy to provide required ec2 launch permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:DetachVolume",
                "ec2:AttachVolume",
                "ec2:RebootInstances",
                "ec2:ResetImageAttribute",
                "ec2:DeregisterImage",
                "ec2:DeleteTags",
                "ec2:CreateTags",
                "ec2:ResetSnapshotAttribute",
                "ec2:RunInstances",
                "ec2:StopInstances",
                "ec2:CreateVolume",
                "ec2:Describe*",
                "ec2:ModifySnapshotAttribute",
                "ec2:StartInstances"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "logs:*",
            "Resource": "arn:aws:logs:*:*:*"
        }
    ]
}

Currently getting the following error while permissions as ec2:RunInstances is enabled

{
  "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: sGOne-.....",
  "errorType": "Function<Aws::EC2::Errors::UnauthorizedOperation>",
  "stackTrace": [
    "/var/runtime/gems/aws-sdk-core-3.40.0/lib/seahorse/client/plugins/raise_response_errors.rb:15:in `call'",
    "/var/runtime/gems/aws-sdk-core-3.40.0/lib/aws-sdk-core/plugins/jsonvalue_converter.rb:20:in `call'",
    "/var/runtime/gems/aws-sdk-core-3.40.0/lib/aws-sdk-core/plugins/idempotency_token.rb:17:in `call'",
    "/var/runtime/gems/aws-sdk-core-3.40.0/lib/aws-sdk-core/plugins/param_converter.rb:24:in `call'",
    "/var/runtime/gems/aws-sdk-core-3.40.0/lib/aws-sdk-core/plugins/response_paging.rb:10:in `call'",
    "/var/runtime/gems/aws-sdk-core-3.40.0/lib/seahorse/client/plugins/response_target.rb:23:in `call'",
    "/var/runtime/gems/aws-sdk-core-3.40.0/lib/seahorse/client/request.rb:70:in `send_request'",
    "/var/runtime/gems/aws-sdk-ec2-1.60.0/lib/aws-sdk-ec2/client.rb:27423:in `run_instances'",
    "/var/runtime/gems/aws-sdk-ec2-1.60.0/lib/aws-sdk-ec2/resource.rb:392:in `create_instances'",
    "/var/task/lambda_function.rb:21:in `lambda_handler'"
  ]
}

Viewing all articles
Browse latest Browse all 29547

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>