AWS CloudWatch 代理：NoCredentialsError：无法找到凭证

Question

I am receiving the following errors in the EC2 CloudWatch Agent logs, /var/logs/awslogs.log :

I verified the EC2 has a role:

And the role has the correct policies:

I have set the correct region in /etc/awslogs/awscli.conf:

I noticed that running aws configure list in the EC2 gives this:

Is this incorrect? Should it list the profile (EC2_Cloudwatch_Profile) there?

Answer 1

I was using terraform and reprovisioning by doing:

terraform destroy && terraform apply

Looks like due to IAM being a global service it is "eventually consistent" and not "immediately consistent", when the profile instance was destroyed, the terraform apply began too quickly. Despite the "destroy" being complete, the arn for the previous profile instance was still there, and was re-used. However, the ID changed to a new ID.

Replacing the EC2 would bring it up to speed with the correct ID. However, my solution is to just wait longer between terraform destroy and apply.