AWS：尝试将指标从 EC2 推送到 CloudWatch 时出现身份验证问题

Question

I am trying to set up an EC2 (RHEL7) instance to push metrics to cloudwatch using perl scripts as described in http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/mon-scripts.html

I get an HTTP status 400 message "The security token included in the request is invalid"

An instance profile is associated with the instance which has the following policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:PutMetricData",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListMetrics"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeTags"
            ],
            "Resource": "*"
        }
    ]
}

I am pulling the AWSAccessKeyId and AWSSecretKey from the instance meta-data as follows:

ROLE=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/)
CRED=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE)

AWSAccessKeyId=$(sed '/AccessKeyId/!d; s/.*:\ \+"\(.\+\)",/\1/g' <<< "$CRED")
AWSSecretKey=$(sed '/SecretAccessKey/!d; s/.*:\ \+"\(.\+\)",/\1/g' <<< "$CRED")

...the values set in the above variables are correct when i check them...

I am running the script to push to cloudwatch as follows (using creds stored in variables from above):

./mon-put-instance-data.pl --mem-util --verbose --aws-access-key-id  $AWSAccessKeyId --aws-secret-key $AWSSecretKey

Any ideas why it is rejecting my credentials?

Thanks in advance

Answer 1

If you're using an IAM profile, you don't need to put in the credentials for your script call. Remove the access key and secret key from your call.

./mon-put-instance-data.pl --mem-util --verbose

Answer 2

Yes. You are both right - it automatically picks up the role creds if you dont specify and seems to work.

Not sure why it doesnt work by manually setting the creds but i can look at the perl script to work this out fairly easily.

Thanks for your help.

Answer 3

From documentation :

The following examples assume that you provided an IAM role or awscreds.conf file. Otherwise, you must provide credentials using the --aws-access-key-id and --aws-secret-key parameters for these commands.

As an option when you get an error:

ERROR: Failed to call CloudWatch: HTTP 400. Message: The security token included in the request is invalid.

the script uses a config file (eg with wrong credentials):

aws-scripts-mon/awscreds.conf

So, an IAM role or awscreds.conf or --aws* params have to be provided. And the IAM role has correct permissions :

cloudwatch:PutMetricData
cloudwatch:GetMetricStatistics
cloudwatch:ListMetrics
ec2:DescribeTags