terraform：创建安全组时出错：UnauthorizedOperation：您无权执行此操作

Question

I have a below terraform script which works fine when use it on terminal.

provider "aws" {
  region = "${var.aws_region}"
}

resource "aws_instance" "jenkins-poc" {
  count = "2"
  ami           = "${var.aws_ami}"
  instance_type = "${var.instance_type}"
  key_name      = "${var.key_name}"
  availability_zone = "${var.aws_region}${element(split(",",var.zones),count.index)}"
  vpc_security_group_ids = ["${aws_security_group.jenkins-poc.id}"]
  subnet_id = "${element(split(",",var.subnet_id),count.index)}"
  user_data = "${file("userdata.sh")}"
  tags {
    Name = "jenkins-poc${count.index + 1}"
    Owner = "Shailesh"
  }
}

resource "aws_security_group" "jenkins-poc" {
  vpc_id = "${var.vpc_id}"
  name = "${var.security_group_name}"
  description = "Allow http,httpd and SSH"

  ingress {
      from_port = 443
      to_port = 443
      protocol = "tcp"
      cidr_blocks = ["10.0.0.0/8"]
  }
  ingress {
      from_port = 22
      to_port = 22
      protocol = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
  }
 ingress {
      from_port = 80
      to_port = 80
      protocol = "tcp"
      cidr_blocks = ["10.0.0.0/8"]
 }
  egress {
      from_port = "0"
      to_port = "0"
      protocol = "-1"
      cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_elb" "jenkins-poc-elb" {
    name = "jenkins-poc-elb"
    subnets = ["subnet-","subnet-"]
listener {
    instance_port = 80
    instance_protocol = "http"
    lb_port = "80"
    lb_protocol = "http"
}

  health_check {
    healthy_threshold = "2"
    unhealthy_threshold = "3"
    timeout = "3"
    target = "tcp:80"
    interval = 30
  }
    instances = ["${aws_instance.jenkins-poc.*.id}"]
}

and variables file is as given below.

variable "aws_ami" {
  default = "ami-"
}

variable "zones"{
  default = "a,b"
}

variable "aws_region" {
    default = "us-east-1"
}

variable "key_name" {
    default = "test-key"
}

variable "instance_type" {
    default = "t2.micro"
}

variable "count" {
    default = "2"
}
variable "security_group_name" {
    default = "jenkins-poc"
}
variable "vpc_id" {
    default = "vpc-"
}
variable "subnet_id" {
    default = "subnet-,subnet"
}

Everything works fine when I run through terminal using terraform apply. But same code gives me below error when I run it through jenkins.

aws_security_group.jenkins-poc: Error creating Security Group: UnauthorizedOperation: You are not authorized to perform this operation

Note :: This is a non-default vpc in which I am performing this operation.

I would highly appreciate any comments. I didn't mention sensitive values.

Answer 1

Just make sure if you are in the right aws profile and the default aws profile could restrict you from creating the instance

provider "aws" {
  region = "${var.aws_region}"
  shared_credentials_file = "~/.aws/credentials"
  profile = "xxxxxxx"
}