停止 EC2 实例

Question

I have a node js application running on EC2. After a certain operation, I want to stop the EC2.

I am using this function to stop EC2

const stopInstance = () => {
    // set the region
    AWS.config.update({
        accessKeyId: "MY ACCESS KEY",
        secretAccesskey: "SECRET KEY",
        region: "us-east-1"
    })

    // create an ec2 object
    const ec2 = new AWS.EC2();

    // setup instance params
    const params = {
        InstanceIds: [
            'i-XXXXXXXX'    
        ]
    };

    ec2.stopInstances(params, function(err, data) {
    if (err) {
        console.log(err, err.stack); // an error occurred
    } else {
        console.log(data);           // successful response
    }  
    });
}

When I am running it from EC2, it's giving error

 UnauthorizedOperation: You are not authorized to perform this operation.

But when I am running the same code, using the same key and secret from my local machine, It's working perfectly .

Permissions I have

Answer 1

This will be down to the permissions of the IAM user being passed into the script.

Firstly this error message indicates that an IAM user/role was successfully used in the request, but failed to have permissions so that can be ruled out.

Assuming a key and secret are being successfully (looks like hard coded) you would be looking at further restrictions within the policy (such as principal or.

If the key and secret are not hard coded but instead passed in as environment variables, perform some debug to output the string values and validate these are what you expect. If they do not get passed into the SDK then it may be falling back to an instance role that is attached.

As a point of improvement, generally when interacting with the AWS SDK/CLI from within AWS (ie on an EC2 instance) you should use a IAM role over an IAM user as this will lead to less API credentials being managed/rotated. An IAM role will rotate temporary credentials for you every few hours.

Answer 2

If the same credentials are working on local machine then it's probably not a permission issue, but just to further isolate the issue, you can try to run the AWS-GetCallerIdentity to check the credentials that are being used.

https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html

In case if this does not help, create a new user and try giving full admin access and then using the credentials to see if this get's resolved. This will confirm whether we are facing a permission issue or not.